ECCIE Forum Breach Exposes 536,923 User Accounts
What Happened — In January 2021 the adult‑escort forum ECCIE was breached; attackers posted 536,923 user records containing email addresses, IP addresses, usernames, dates of birth, and salted MD5 password hashes on a public hacking forum.
Why It Matters for Trust & Control Assurance —
- The incident highlights the risk of weak credential‑storage controls; continuous monitoring of password‑hashing practices is a core control‑assurance activity.
- Evidence of strong hashing algorithms and MFA can be used to demonstrate due‑diligence in audits.
- A defensible audit trail of credential‑access logs helps prove that controls were in place before the breach.
Who Is Affected — Online platforms that host adult‑entertainment services or any web‑based community storing personal identifiers and passwords.
Recommended Actions — Review password‑hashing algorithms and migrate from MD5 to a modern KDF (e.g., bcrypt, Argon2); enforce multi‑factor authentication; implement continuous monitoring for credential leakage and retain logs as audit evidence. Source: https://haveibeenpwned.com/api/v3/breach/ECCIE
Technical Notes — Data types exposed: email, IP, username, date of birth, salted MD5 password hashes. The breach was disclosed on a hacking forum; no specific vulnerability was publicly identified. Source: https://haveibeenpwned.com/api/v3/breach/ECCIE