Eskimi AdTech Platform Breach Exposes 1.2 M User Accounts and Unsalted MD5 Password Hashes
What Happened — In late 2020 the advertising‑technology platform Eskimi suffered a data breach that released roughly 1.2 million unique user records. The exposed data set included usernames, email addresses, dates of birth, gender, geographic location and passwords that were stored as unsalted MD5 hashes.
Why It Matters for Trust & Control Assurance
- The incident illustrates a classic control‑gap: inadequate credential protection and weak hashing practices, which a continuous control‑assurance program is designed to detect and remediate.
- Demonstrating defensible evidence that password‑storage policies meet industry‑accepted standards (e.g., salted, slow‑hash algorithms) satisfies a single control objective that maps to many frameworks (access control, credential management).
- Leveraging Verisq’s Access Controls capability provides ongoing verification that hashing, rotation, and credential‑use policies remain enforceable and auditable.
Who Is Affected
- Advertising technology (AdTech) providers and their advertisers.
- Any organization that integrated Eskimi’s SDK or API for audience targeting.
Recommended Actions
- Conduct an immediate inventory of all credential‑storage mechanisms; verify that passwords use salted, computationally‑hard hash functions (e.g., bcrypt, Argon2).
- Implement continuous monitoring of password‑policy compliance and generate audit‑ready evidence for the “credential protection” control objective.
- Prompt affected users to reset passwords and enforce multi‑factor authentication where possible.
Source: Have I Been Pwned – Eskimi breach
Technical Notes
- Attack vector: exploitation of weak password‑hash storage (unsalted MD5) likely combined with credential‑dump acquisition.
- No specific CVE; the weakness is a design/implementation flaw in credential handling.
- Data types exposed: usernames, email addresses, dates of birth, gender, geographic location, and password hashes.
Source: same as above