Historic Breach Exposes 846,742 Email Addresses and Password Hashes from Baby Names
What Happened – In a breach dating back to at least 2008, the Baby Names website (babynames.com) suffered unauthorized access that exposed 846,742 user accounts. The compromised data included email addresses and passwords stored as salted MD5 hashes. The site disclosed the incident in 2018, noting that members had been notified at the time of the breach.
Why It Matters for Trust & Control Assurance
- This incident illustrates the risk of weak credential‑storage practices—an area continuous control‑assurance programs monitor to prove defensible security hygiene.
- Demonstrating robust password‑hashing, regular credential‑rotation, and evidence of monitoring satisfies a core control objective that maps to many frameworks (e.g., NIST CSF 2.0).
- Leveraging Verisq’s Access Controls capability lets you collect, automate, and present proof that your password‑management controls are operating as intended.
Who Is Affected – Consumer‑focused web services, online communities, and any organization that stores user credentials.
Recommended Actions
- Review and upgrade password‑hashing algorithms (e.g., migrate from MD5 to bcrypt, Argon2, or PBKDF2).
- Implement multi‑factor authentication for user accounts where feasible.
- Establish continuous monitoring of credential‑storage controls and retain audit‑ready evidence of compliance.
Technical Notes – The breach involved legacy salted MD5 hashes, a cryptographic primitive considered insecure by modern standards. No specific exploit or vulnerability was disclosed; the breach appears to stem from inadequate protection of credential data. Source: [Have I Been Pwned – Baby Names Breach]