Brazzers Breach Exposes 790,724 Plain‑Text User Credentials
What Happened – In April 2013 the adult‑content site Brazzers was compromised, and a data‑dump containing 790,724 user records (email address, username, and password in clear text) was published by the Vigilante.pw reporting site in September 2016.
Why It Matters for Trust & Control Assurance
- Storing passwords in plain text violates basic credential‑management controls and makes it impossible to prove a defensible password‑policy audit trail.
- Continuous monitoring of credential‑handling processes would surface insecure storage before a breach occurs, providing evidence of due‑diligence.
- Demonstrating strong access‑control safeguards (encryption at rest, privileged‑access reviews) aligns with control objectives that satisfy multiple frameworks (e.g., NIST CSF, ISO 27001).
Who Is Affected – Online adult‑entertainment platforms and any service that handles consumer credentials without strong encryption.
Recommended Actions
- Immediately enforce hashing (e.g., bcrypt, Argon2) for all stored passwords and retire any clear‑text copies.
- Conduct a credential‑storage audit against your control‑objective for password protection and document evidence for audit readiness.
- Deploy continuous monitoring to detect insecure storage configurations and generate real‑time alerts.
Source: Have I Been Pwned – Brazzers breach
Technical Notes
- Attack vector not publicly disclosed; breach resulted in full credential exposure.
- Data types exposed: email addresses, usernames, and plaintext passwords.
Source: same as above