Chatbooks Breach Exposes 2.5 M User Accounts with Personal Data and Password Hashes
What Happened — In March 2020 the photo‑print service Chatbooks suffered a data breach that was later listed for sale on a dark‑web marketplace. The leak contained 15 million records, including 2,520,441 unique email addresses, names, phone numbers, social‑media profile links, and salted SHA‑512 password hashes.
Why It Matters for Trust & Control Assurance
- Continuous monitoring of credential‑storage controls is essential to detect and remediate weak hashing or exposure before it becomes audit‑critical.
- Maintaining defensible evidence of encryption, access policies, and third‑party data‑handling procedures supports a robust control‑assurance posture.
- Proactive leak‑detection (e.g., dark‑web monitoring) provides the audit trail needed to demonstrate due‑diligence to regulators and partners.
Who Is Affected – Consumers of the Chatbooks photo‑print platform (Tech SaaS / consumer‑focused services).
Recommended Actions – Review and upgrade password‑hashing algorithms; enforce multi‑factor authentication for all user accounts; implement continuous dark‑web credential monitoring; document storage and access controls to satisfy audit evidence requirements. Source: https://haveibeenpwned.com/api/v3/breach/Chatbooks
Technical Notes – Exfiltrated data included email addresses, names, phone numbers, social‑media profile URLs, and salted SHA‑512 password hashes. The breach was first reported by dehashed.com and added to Have I Been Pwned. Source: https://haveibeenpwned.com/api/v3/breach/Chatbooks