11 Million Email Addresses and Plain‑Text Passwords Exposed from Coupon Mom and Armor Games
What Happened – A data set containing 11,010,525 email addresses and their associated plain‑text passwords was posted online in 2014. The dump links the credentials to accounts on Coupon Mom and Armor Games, and later was found to also include BeerAdvocate accounts. Although the source cannot be definitively proven, the breach was verified by Have I Been Pwned (HIBP) subscribers.
Why It Matters for Trust & Control Assurance
- Credential reuse across consumer services creates a single point of failure that continuous‑control monitoring is designed to detect and mitigate.
- Demonstrable evidence of password‑policy enforcement, MFA adoption, and credential‑rotation processes is essential for a defensible audit trail.
- The incident underscores the need for ongoing vendor‑risk oversight of third‑party platforms that store user credentials.
Who Is Affected – Online gaming platforms, coupon/discount services, and any other consumer‑facing web applications that may share users with these sites.
Recommended Actions –
- Enforce multi‑factor authentication for all user accounts.
- Prompt users to change passwords and implement a password‑strength policy.
- Deploy credential‑reuse detection tools and monitor for leaked credentials in dark‑web feeds.
- Document the response and collect evidence to satisfy control‑assurance requirements.
Technical Notes – The breach originated from an unverified external dump; no specific vulnerability was disclosed. The exposed data consists of email addresses and clear‑text passwords, indicating that the affected services stored passwords without adequate hashing. Source: https://haveibeenpwned.com/api/v3/breach/CouponMomAndArmorGames