Dubsmash Breach Exposes 162 Million User Accounts, Including Password Hashes
What Happened — In December 2018 the video‑messaging platform Dubsmash suffered a data breach that exposed approximately 162 million unique user records. The leaked data included email addresses, usernames, PBKDF2‑hashed passwords, phone numbers, geographic locations, spoken languages, and full names. The compromised dataset appeared for sale on a dark‑web marketplace in 2019 and has since been widely circulated.
Why It Matters for Trust & Control Assurance
- The incident illustrates the risk of inadequate credential‑storage controls; continuous assurance programs require proof that passwords are salted, hashed with strong algorithms, and regularly rotated after a breach.
- Detecting and documenting credential exposure is a core element of an ongoing control‑monitoring regime, providing defensible evidence for auditors and regulators.
- A robust incident‑response and breach‑notification process is essential to demonstrate due diligence and maintain stakeholder trust after large‑scale data loss.
Who Is Affected – Consumer‑media and social‑app providers, any organization that stores user‑generated content and credential data at scale.
Recommended Actions
- Verify that password‑hashing mechanisms meet current best‑practice standards (e.g., PBKDF2 with sufficient iteration count, or migration to Argon2).
- Initiate a forced password reset for all affected accounts and communicate the change through a transparent breach‑notification process.
- Deploy continuous credential‑leak monitoring to detect future exposures of your user data on underground forums.
- Document the incident response steps and retain evidence (logs, forensic reports) to satisfy audit‑readiness requirements.
Technical Notes – The breach’s exact attack vector was not disclosed; the exposure involved PBKDF2 password hashes, email addresses, usernames, phone numbers, geographic locations, spoken languages, and full names. Source: Have I Been Pwned – Dubsmash breach