Elance Staffing Platform Breach Exposes 1.29 M User Accounts (2009)
What Happened — In 2009 the freelance‑staffing marketplace Elance suffered a data breach that impacted 1,291,178 user accounts. The leaked dataset, made public in 2017 via Have I Been Pwned, contains usernames, email addresses, phone numbers, employer information, geographic locations, and SHA‑1 password hashes.
Why It Matters for Trust & Control Assurance
- Credential exposure highlights the need for strong password‑storage controls and regular hashing algorithm reviews.
- Continuous monitoring of access‑control policies provides defensible evidence that credential protection meets audit expectations.
- Demonstrating a documented incident‑response workflow for legacy breaches strengthens overall control‑assurance posture.
Who Is Affected — Freelance professionals, staffing agencies, and any organizations that sourced talent through Elance (professional services sector).
Recommended Actions
- Conduct a password‑policy audit and migrate all stored passwords to a modern, salted hash (e.g., Argon2, bcrypt).
- Enforce multi‑factor authentication for all legacy accounts and any remaining integrations.
- Document the remediation steps and collect evidence for audit readiness (policy updates, hashing algorithm change logs).
Source: Have I Been Pwned – Elance breach
Technical Notes
- Attack vector not disclosed; breach likely stemmed from inadequate credential protection practices of the era.
- SHA‑1 hashes are considered weak and vulnerable to collision attacks.
Source: same as above