Drizly Data Breach Exposes 2.48 M User Accounts
What Happened – In July 2020 the online alcohol‑delivery platform Drizly suffered a data breach that exposed 2,479,044 user records. The leaked set included email addresses, names, physical and IP addresses, phone numbers, dates of birth and bcrypt‑hashed passwords. The data appeared for sale on underground forums and was later added to Have I Been Pwned.
Why It Matters for Trust & Control Assurance
- This incident illustrates the exact scenario a continuous control‑assurance program is built to prevent: inadequate protection of credential stores and insufficient monitoring of privileged access.
- Demonstrating robust identity‑access controls, regular password‑policy enforcement, and auditable evidence of credential‑handling can provide a defensible audit trail and reduce exposure to similar breaches.
Who Is Affected – Retail/e‑commerce firms handling consumer‑level personally identifiable information (PII), especially those storing passwords or other credential data.
Recommended Actions
- Review and harden password‑storage practices (e.g., enforce strong hashing, rotate salts).
- Deploy multi‑factor authentication (MFA) for all privileged and user accounts.
- Implement continuous monitoring of credential‑related logs and generate evidence for audit readiness.
Technical Notes – The breach involved the unauthorized extraction of a database containing bcrypt‑hashed passwords and associated PII. No specific vulnerability (CVE) was disclosed; the attack vector remains unknown. Source: https://haveibeenpwned.com/api/v3/breach/Drizly