Disqus Breach Exposes 17.5 M Email Addresses, Usernames, and Password Hashes
What Happened – In July 2012 attackers accessed Disqus’s user database, extracting 17,551,044 unique email addresses, usernames, and salted SHA‑1 password hashes. The intrusion remained undetected until October 2017, when Disqus publicly disclosed the breach.
Why It Matters for Trust & Control Assurance
- Highlights the risk of weak password‑storage algorithms; continuous monitoring of credential‑protection controls is essential to prove you’re meeting audit expectations.
- Demonstrates the need for documented, defensible evidence that password policies (hashing, salting, MFA) are enforced across all user accounts.
- Provides a real‑world example of why a robust identity‑and‑access‑management program must be part of any control‑assurance strategy. (Relevant capability: ACCESS_CONTROLS)
Who Is Affected – SaaS platforms, publishers, and any organization that integrated Disqus commenting on their sites; broadly, any entity that stores user credentials.
Recommended Actions
- Force password resets for all Disqus users and any accounts that reused those credentials.
- Upgrade password hashing to modern algorithms (e.g., bcrypt, Argon2) and enforce multi‑factor authentication where possible.
- Document and continuously monitor credential‑storage controls, capturing evidence for audit readiness. Source: Have I Been Pwned – Disqus Breach
Technical Notes
- Attack vector: currently unknown; breach likely stemmed from compromised internal systems or insufficient database segmentation.
- Exposed data: email addresses, usernames, salted SHA‑1 password hashes. Source: Have I Been Pwned – Disqus Breach