ClixSense Breach Exposes 2.4M User Accounts, Including Plain‑Text Passwords
What Happened – In September 2016 the paid‑to‑click platform ClixSense suffered a data breach that exposed 2,424,784 subscriber records. The leaked dataset included names, email and physical addresses, dates of birth, gender, IP addresses, account balances, payment histories, payment methods, and passwords stored in plain text. Attackers posted the data online, claiming it was part of a larger breach of 6.6 million records.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of inadequate credential protection – a core control that continuous‑monitoring programs must verify and evidence.
- Highlights the need for auditable password‑storage policies (hashing, salting, rotation) to satisfy multiple frameworks through a single control objective.
- Provides a real‑world trigger for incident‑response documentation and proof of due‑diligence in breach handling.
Who Is Affected – Online platforms that collect personal and financial data (tech‑SaaS, ad‑tech, micro‑task marketplaces).
Recommended Actions
- Conduct an immediate review of password storage mechanisms; enforce strong hashing (e.g., bcrypt, Argon2) and eliminate plain‑text storage.
- Rotate all compromised credentials and require multi‑factor authentication for user accounts.
- Update incident‑response playbooks to capture evidence of credential‑management controls and generate audit‑ready logs.
Technical Notes – Attack vector not publicly disclosed; breach appears to stem from a database compromise or insider exposure. No CVE associated. Data types exposed: personal identifiers, financial details, and authentication credentials. Source: https://haveibeenpwned.com/api/v3/breach/ClixSense