1.3 M Membership Records Exposed from Ducks Unlimited – Passwords Stored as Unsalted MD5
What Happened — In mid‑2021 a database containing 1,324,364 Ducks Unlimited accounts surfaced on underground forums. The dump included names, email addresses, phone numbers, physical addresses, dates of birth and passwords that were only protected by unsalted MD5 hashes.
Why It Matters for Trust & Control Assurance
- Storing passwords with weak, unsalted hashes violates basic credential‑security controls that a continuous‑monitoring program must evidence.
- The breach illustrates the need for documented password‑policy enforcement and regular proof that cryptographic controls meet industry‑accepted standards.
- Demonstrating remediation (e.g., salted hashing, forced password rotation) provides defensible audit evidence across multiple frameworks.
Who Is Affected — Non‑profit conservation organizations, membership‑based NGOs, and any entity that maintains similar member‑portal databases.
Recommended Actions
- Immediately force password resets for all compromised accounts and migrate to a modern, salted hashing algorithm (e.g., bcrypt, Argon2).
- Conduct a control‑mapping exercise to verify that credential‑storage policies align with your audit‑readiness framework.
- Capture evidence of the updated hashing process and password‑reset workflow for continuous‑control monitoring.
Technical Notes — The exposed data originated from a 2021 snapshot; passwords were stored as unsalted MD5 hashes, a known weak algorithm vulnerable to rainbow‑table attacks. No specific CVE is associated, but the practice contravenes NIST SP 800‑63B guidance on secret authentication. Source: [Have I Been Pwned – Ducks Unlimited breach]