ClickASnap Breach Exposes 3.26 M User Accounts, Including Password Hashes and Personal Details
What Happened – In September 2022 the online photo‑sharing service ClickASnap suffered a data breach that released personal records for 3,262,980 accounts. Exposed data includes email addresses, usernames, SHA‑512 password hashes, names, physical addresses, and subscription payment details.
Why It Matters for Trust & Control Assurance
- The breach demonstrates a failure to protect credential data, a core scenario that continuous control‑assurance programs are built to detect and remediate.
- Demonstrable evidence of strong identity‑and‑access‑management controls (e.g., password hashing standards, credential monitoring) is essential for audit readiness and defensible post‑incident reporting.
- Mapping this incident to the Access Control control objective provides a single control that satisfies multiple frameworks (e.g., NIST CSF 2.0, ISO 27001).
Who Is Affected – Consumer‑facing SaaS platforms that store user credentials and personal data; primarily the technology/SaaS sector.
Recommended Actions
- Review password storage practices against industry‑accepted hashing and salting standards; upgrade if needed.
- Implement continuous monitoring of credential‑related controls and retain evidence for audit trails.
- Conduct a post‑breach forensic review and update incident‑response playbooks to include credential‑exposure scenarios.
Source: Have I Been Pwned – ClickASnap breach
Technical Notes – The breach exposed SHA‑512 password hashes, indicating that passwords were stored without additional salting or key‑stretching mechanisms. No specific vulnerability (CVE) was disclosed, and the attack vector remains unknown.