Disk Union – 690,667 Customer Accounts Breached, Including Plain‑Text Passwords
What Happened – In June 2022 the Japanese record‑store chain Disk Union suffered a data breach that exposed 690,667 unique accounts. The leak included email addresses, names, post codes, phone numbers, usernames and plain‑text passwords.
Why It Matters for Trust & Control Assurance
- The breach is a textbook example of a control gap in credential protection that a continuous‑control‑assurance program is designed to detect and remediate.
- Demonstrable evidence of password hashing, privileged‑access monitoring and immutable logging is required to provide a defensible audit trail.
- Mapping this incident to the Protect function of NIST CSF 2.0 shows how a single control objective (secure credential storage) satisfies multiple framework requirements.
Who Is Affected – Retail‑focused consumer‑goods businesses and their customers; any organization that stores passwords without strong cryptographic protection.
Recommended Actions
- Conduct an immediate audit of all password storage mechanisms; enforce industry‑standard hashing (e.g., bcrypt, Argon2).
- Force a password reset for all affected users and enable multi‑factor authentication where possible.
- Deploy continuous monitoring of privileged‑access activity and retain immutable logs for audit readiness.
- Update data‑handling policies to require encryption at rest for all credential data.
Technical Notes – The breach appears to stem from insecure storage of credentials (plain‑text passwords) rather than a known exploit; no specific CVE is cited. Exposed data types: email, name, geographic location, phone number, username, password. Source: https://haveibeenpwned.com/api/v3/breach/DiskUnion