Coinmama Breach Exposes 478,824 Email Addresses, Usernames, and Password Hashes
What Happened — In August 2017 the cryptocurrency brokerage Coinmama suffered a data breach that was only discovered in February 2019. The breach exposed 478,824 records containing email addresses, usernames, and passwords stored as unsalted MD5 WordPress hashes. The compromised data was later submitted to Have I Been Pwned by a white‑hat researcher.
Why It Matters for Trust & Control Assurance
- Weak password hashing is a classic control gap that a continuous control‑assurance program should detect, document, and remediate.
- Evidence of proper credential‑storage policies (e.g., modern hashing, rotation, monitoring) is essential for a defensible audit trail.
- The incident underscores the need for ongoing verification that access‑control mechanisms remain aligned with security best practices.
Who Is Affected — Customers of the crypto‑exchange/financial‑services platform Coinmama and, by extension, any organization that stores user credentials without strong cryptographic protection.
Recommended Actions
- Replace MD5 hashes with a modern, salted algorithm such as bcrypt or Argon2 and enforce periodic password changes.
- Deploy continuous monitoring of credential‑storage configurations and retain evidence of compliance for audit readiness.
- Conduct a control‑mapping review against your framework of record to confirm that password‑protection controls are adequately documented.
Technical Notes — The exposed passwords were stored as MD5 WordPress hashes, a legacy format vulnerable to rapid offline cracking. No specific CVE is associated; the issue stems from insecure configuration and outdated hashing practices.