E-Pal Breach Exposes 108,887 User Accounts and Purchase Data
What Happened — In October 2022, the Discord‑focused matchmaking service E‑Pal disclosed that an unauthorized party accessed its database, compromising 108,887 user records. The exposed data included email addresses, usernames and details from roughly one‑million purchase orders. The stolen files were later posted on a public hacking forum.
Why It Matters for Trust & Control Assurance —
- Demonstrates the need for continuous identity‑and‑access‑control monitoring to detect unauthorized data access.
- Highlights the importance of maintaining auditable evidence of access‑right reviews and privileged‑account usage.
- Underlines how a robust incident‑response and evidence‑preservation process supports defensible audit trails. (Relevant capability: ACCESS_CONTROLS)
Who Is Affected — Users of the E‑Pal platform, primarily members of Discord communities and broader online‑gaming/social‑media audiences.
Recommended Actions —
- Review and tighten authentication mechanisms (MFA, password policies) for all privileged and user accounts.
- Implement continuous access‑log monitoring and retain logs for forensic analysis.
- Update incident‑response playbooks to include rapid evidence collection and breach notification procedures. Source: https://haveibeenpwned.com/api/v3/breach/EPal
Technical Notes — The breach was disclosed via Have I Been Pwned; no specific vulnerability (e.g., CVE) was identified, and the attack vector remains unknown. Exfiltrated data comprised email addresses, usernames and purchase order metadata. Source: https://haveibeenpwned.com/api/v3/breach/EPal