CityBee Car‑Sharing Service Exposes 110,156 Customer Records Including Unsalted SHA‑1 Password Hashes
What Happened – In February 2021 the Lithuanian car‑sharing platform CityBee announced a data breach that compromised 110,156 user accounts. The exposed data set contains names, email addresses, government‑issued identification numbers, and passwords that were stored as unsalted SHA‑1 hashes.
Why It Matters for Trust & Control Assurance
- Weak password hashing is a classic control‑gap that continuous‑control‑assurance programs are built to detect and remediate.
- Demonstrating robust credential‑management controls (strong hashing, MFA, audit logs) provides defensible evidence for multiple compliance frameworks.
- Ongoing monitoring of password‑storage practices helps maintain a trustworthy posture and reduces the risk of future data‑exfiltration incidents.
Who Is Affected – Transportation & mobility services, car‑sharing platforms, and any organization that stores user credentials without strong cryptographic safeguards.
Recommended Actions
- Replace unsalted SHA‑1 hashes with salted, computationally‑hard algorithms such as bcrypt or Argon2.
- Enforce multi‑factor authentication for all user accounts.
- Document and continuously monitor password‑policy enforcement to produce audit‑ready evidence of credential protection. Source: Have I Been Pwned – CityBee breach
Technical Notes – The breach involved passwords stored as unsalted SHA‑1 hashes, a deprecated algorithm vulnerable to pre‑image attacks. Exposed personal data also includes government‑issued IDs, increasing identity‑theft risk. Source: HIBP breach details