Bookmate Exposes 3.8M User Accounts in 2018 Data Breach
What Happened – In mid‑2018 the ebook‑subscription service Bookmate was breached, resulting in the theft of 3,830,916 user records. The data set contained names, email addresses, dates of birth, genders, geographic locations, usernames and passwords stored as salted SHA‑512 hashes. The stolen information was later sold on underground markets in early 2019.
Why It Matters for Trust & Control Assurance
- Demonstrates a lapse in credential protection and password‑hashing practices – a core control objective for any organization that stores user credentials.
- Highlights the need for continuous monitoring of credential access and defensible audit evidence that hashing algorithms and MFA controls are effective.
- Aligns with the Access Controls capability, enabling organizations to prove they have robust identity‑management and password‑security controls in place.
Who Is Affected – SaaS and digital content platforms, broader technology‑as‑a‑service providers handling consumer accounts.
Recommended Actions
- Audit your password storage mechanisms; upgrade to memory‑hard hashing (e.g., Argon2) and rotate salts regularly.
- Enforce multi‑factor authentication for all user accounts and implement continuous monitoring for credential abuse.
- Collect and retain evidence of these controls to support audit readiness and regulatory inquiries.
Technical Notes – The breach exposed personal identifiers (name, email, DOB, gender, location) and password hashes generated with salted SHA‑512. No specific vulnerability or CVE was disclosed; the attack vector remains unknown.