England Cricket – 43,299 User Accounts Exposed in Website Breach
What Happened — In March 2024 the public‑facing “icoachcricket” portal of England Cricket suffered a data breach that released 43,299 user records. The exposed data comprised email addresses and password hashes stored as bcrypt, salted MD5, or a combination of both.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk when credential storage does not meet strong cryptographic standards – a gap continuous‑control monitoring is designed to surface.
- Highlights the need for documented evidence that authentication controls (password hashing, rotation, MFA) are enforced and auditable.
- Provides a concrete incident that can be mapped to the “secure credential management” control objective, which underpins many frameworks (e.g., NIST CSF 2.0).
Who Is Affected – Sports & entertainment organizations that run member‑facing portals; any entity that stores user passwords without robust hashing.
Recommended Actions
- Review and upgrade password‑storage algorithms to industry‑accepted standards (e.g., Argon2, bcrypt with appropriate cost).
- Implement multi‑factor authentication for all user accounts and enforce periodic password changes.
- Capture and retain evidence of credential‑policy enforcement in a continuous‑control‑assurance platform.
Source: Have I Been Pwned – England Cricket breach
Technical Notes
- Attack vector: Likely a misconfiguration or insufficient protection of the authentication database, leading to unauthorized extraction.
- Data types: Email addresses, password hashes (bcrypt, salted MD5).
- Records affected: 43,299.
Source: Same as above