Evermotion Data Breach Exposes 435,510 User Accounts
What Happened – In May 2015 the Polish 3‑D‑modelling site Evermotion suffered a breach of its vBulletin forum. Attackers extracted 435,510 unique records containing email addresses, usernames, dates of birth and salted MD5 password hashes.
Why It Matters for Trust & Control Assurance
- The incident illustrates a failure to enforce strong credential protection and password‑storage controls—exactly the scenario a continuous identity‑and‑access‑control assurance program is built to prevent and document.
- Demonstrable evidence of password‑policy enforcement, hashing standards, and regular access‑review audits provides a defensible trail for auditors and regulators.
- Mapping this breach to the “Identity & Access Management” control objective satisfies requirements across frameworks such as NIST CSF 2.0, ISO 27001 and others.
Who Is Affected – Online platforms that host user‑generated content (e.g., forums, SaaS portals) and their users, primarily in the technology / creative‑services sector.
Recommended Actions
- Verify that password storage uses modern, computationally‑hard hashing (e.g., Argon2, bcrypt) and that salts are unique per user.
- Conduct a credential‑access review: enforce MFA, rotate privileged credentials, and monitor for anomalous login activity.
- Document the controls and evidence in a continuous monitoring system to support audit readiness.
Technical Notes – The breach originated from a compromised vBulletin installation, likely exploiting a known vulnerability or weak admin credentials. Exposed data included salted MD5 hashes, which are considered weak by today’s standards. Source: Have I Been Pwned – Evermotion