Brand New Tube Breach Exposes 350k User Accounts, Including Unsalted SHA‑1 Password Hashes
What Happened — In August 2022 the streaming platform Brand New Tube suffered a data breach that released personal data for 349,627 subscribers. Exposed fields include email addresses, IP addresses, usernames, genders, private messages, and passwords stored as unsalted SHA‑1 hashes.
Why It Matters for Trust & Control Assurance
- The incident highlights a failure in credential protection—a core control objective for any continuous control‑assurance program.
- Demonstrates the need for auditable evidence that password‑storage policies meet strong cryptographic standards and are regularly validated.
- Aligns with the Access Controls capability, which helps organizations prove they enforce secure authentication and maintain defensible audit trails.
Who Is Affected – Media & entertainment streaming services and their subscribers.
Recommended Actions – Review and upgrade password‑hashing mechanisms (e.g., migrate to salted bcrypt/argon2), conduct a credential‑exposure audit, and document the remediation steps in your control‑monitoring system. Source: https://haveibeenpwned.com/api/v3/breach/BrandNewTube
Technical Notes – The breach exposed unsalted SHA‑1 password hashes, a weak algorithm vulnerable to pre‑image attacks. No specific CVE or exploit was disclosed; the exposure appears to stem from inadequate storage practices. Source: https://haveibeenpwned.com/api/v3/breach/BrandNewTube