Digital Banking App Dave Exposes Nearly 3 Million Accounts in Critical Data Breach
What Happened
In June 2020 the Dave digital‑banking application suffered a breach that resulted in the public release of 7.5 million rows of personal data. Approximately 2.96 million unique user records—including email addresses, names, dates of birth, phone numbers, physical addresses, encrypted Social Security numbers and bcrypt‑hashed passwords—were posted on a hacking forum and later indexed by Have I Been Pwned.
Why It Matters for Compliance & Audit Readiness
- Demonstrates the need for continuous control‑assurance over credential storage, ensuring passwords are hashed with strong, up‑to‑date algorithms and that encryption keys are protected.
- Highlights the importance of maintaining auditable data‑classification inventories so that personal identifiers are protected in accordance with regulations such as GDPR, CCPA, and GLBA.
- Shows that a robust incident‑response documentation process is essential for timely breach notification and evidence collection during audits.
Who Is Affected
- Financial services and fintech providers operating digital‑banking platforms.
- Any organization that stores personally identifiable information (PII) comparable to the exposed data set.
- Third‑party service providers that integrate with Dave’s APIs or share customer data.
Recommended Actions
- Review all vendor contracts for data‑protection clauses and confirm Dave’s remediation steps.
- Validate that password‑hashing mechanisms meet current NIST recommendations and that encryption of SSNs is end‑to‑end.
- Request a detailed incident‑response report from Dave, including timelines, root‑cause analysis, and corrective actions.
- Strengthen continuous monitoring controls for unauthorized data exfiltration and public exposure.
Technical Notes
- Attack vector: Likely external compromise of data storage; exact method not disclosed.
- CVE identifiers: None reported.
- Data types exposed: Email addresses, names, dates of birth, phone numbers, physical addresses, encrypted Social Security numbers, bcrypt‑hashed passwords.
Source: https://haveibeenpwned.com/api/v3/breach/Dave