Estante Virtual Breach Exposes 5.4 M Brazilian Customers' Personal Data
What Happened — In February 2019 the Brazilian online bookstore Estante Virtual suffered a data breach that disclosed personal information for 5,412,603 accounts. The leaked data set includes names, usernames, email addresses, physical addresses, phone numbers, dates of birth, and unsalted SHA‑1 password hashes.
Why It Matters for Trust & Control Assurance —
- The incident demonstrates a failure to apply strong credential‑storage controls—a core control objective that continuous‑monitoring programs are built to verify and evidence.
- Weak password hashing (unsalted SHA‑1) undermines the integrity of authentication mechanisms, exposing organizations to credential‑theft risk and downstream compliance gaps.
- Documented evidence of proper access‑control policies and hashing standards is a key audit artifact for frameworks such as NIST CSF 2.0 and ISO 27001.
Who Is Affected — Retail e‑commerce platforms, online marketplaces, and any service that stores consumer‑identifying data and passwords.
Recommended Actions —
- Conduct an immediate inventory of credential‑storage mechanisms and verify use of salted, computationally‑hard hash functions (e.g., bcrypt, Argon2).
- Map the credential‑storage control to your audit‑readiness framework and capture evidence of the hashing algorithm, salt usage, and key‑rotation policies.
- Deploy continuous monitoring to detect insecure password‑hash configurations and generate defensible audit logs.
Source: Have I Been Pwned – Estante Virtual breach
Technical Notes — The breach exposed unsalted SHA‑1 password hashes, a known weak algorithm vulnerable to pre‑image attacks. No specific CVE or exploit was disclosed; the exposure appears to stem from inadequate data‑at‑rest protection. Source: same as above