Appen Data Breach Exposes 5.9 Million User Credentials and Personal Details
What Happened – In June 2020 the AI‑training data provider Appen suffered a breach that resulted in the public release of 5,888,405 user records. The exposed data included names, email addresses, bcrypt‑hashed passwords, phone numbers, employer information and IP addresses. The data set was later posted for sale on underground forums and was added to Have I Been Pwned.
Why It Matters for Trust & Control Assurance
- The incident illustrates the risk of inadequate credential protection and the need for continuous monitoring of password‑storage controls.
- Demonstrates why a defensible audit trail of access‑control policies, MFA enforcement and hashing standards is essential for audit readiness.
- Highlights the value of an ongoing third‑party assurance program that can surface gaps in identity‑and‑access controls before a breach occurs.
Who Is Affected – Companies that rely on Appen’s data‑labeling platform (AI/ML SaaS providers), as well as the 5.9 M individual users whose personal and credential data were exposed.
Recommended Actions
- Verify that all stored passwords use a strong, adaptive hashing algorithm (e.g., bcrypt with appropriate work factor) and rotate any potentially compromised credentials.
- Implement multi‑factor authentication for all privileged and user accounts accessing sensitive data.
- Deploy continuous credential‑access monitoring to detect anomalous logins and generate evidence for audit purposes.
- Review and document your password‑policy and access‑control procedures to ensure they meet the control objective of “credential protection.”
Source: Have I Been Pwned – Appen breach
Technical Notes – The breach’s exact entry vector has not been disclosed; however, the exposure of bcrypt hashes suggests that credential stores were accessed, possibly via compromised admin credentials or a mis‑configured database. No specific CVE is associated with this incident.