67,973 Email Addresses and Plain‑Text Passwords Exposed from Swiss DVD‑Shop.ch
What Happened — In December 2017 the e‑commerce site dvd‑shop.ch suffered a breach that released roughly 68 k user records, including email addresses and passwords stored in clear text. The site is now offline and displays a closure notice.
Why It Matters for Trust & Control Assurance
- The incident illustrates a failure to protect authentication credentials—a core control that continuous‑monitoring programs must verify and evidence.
- Plain‑text password storage bypasses basic cryptographic safeguards, making it difficult to demonstrate compliance with audit‑ready password‑management policies.
- Detecting and documenting such gaps early supports a defensible audit trail and reduces the risk of credential‑reuse attacks across the supply chain.
Who Is Affected – Retail and e‑commerce operators that collect consumer credentials, especially small‑to‑mid‑size online stores.
Recommended Actions – Review password‑storage practices, enforce salted hashing, enable multi‑factor authentication, and capture evidence of credential‑policy enforcement for audit readiness. Source: Have I Been Pwned – DVDShopCH breach
Technical Notes – The breach exposed email addresses and clear‑text passwords; no specific vulnerability (CVE) was disclosed, suggesting insecure data handling rather than a known exploit. Source: same as above