Artsy Breach Exposes Over 1 Million User Accounts, Including Password Hashes
What Happened — In April 2018 the online arts platform Artsy suffered a data breach that compromised 1,079,970 user accounts. The exposed data set included email addresses, IP addresses, names, and passwords stored as salted SHA‑512 hashes. The breached data later appeared for sale on a dark‑web marketplace.
Why It Matters for Trust & Control Assurance
- Continuous credential‑protection monitoring is a core control‑objective; a breach of password hashes shows the risk of inadequate hashing or key‑management practices.
- Defensible audit evidence of how passwords are salted, hashed, and rotated is essential to demonstrate compliance across frameworks (e.g., NIST CSF, ISO 27001).
- The incident underscores the need for an incident‑response playbook that documents evidence collection for credential‑exposure events.
Who Is Affected — Media & entertainment platforms, SaaS services handling user credentials, and any organization that stores password hashes.
Recommended Actions
- Force a password reset for all users and require multi‑factor authentication.
- Verify that password storage uses strong, salted hashing (e.g., SHA‑512 with unique salts) and document the process.
- Deploy continuous monitoring of credential‑storage controls and retain logs as audit evidence.
- Update incident‑response procedures to include credential‑exposure scenarios and evidence‑preservation steps.
Source: Have I Been Pwned – Artsy breach
Technical Notes
- Data types exposed: email addresses, IP addresses, names, password hashes (salted SHA‑512).
- Breach date: April 2018; data appeared for sale on a dark‑web marketplace shortly thereafter.
Source: Have I Been Pwned – Artsy breach