871,190 User Accounts Exposed in Everybody Edits Data Breach
What Happened — In March 2019 the multiplayer platform Everybody Edits suffered a data breach that released 871,190 unique email addresses, usernames, and IP addresses. The compromised data was later posted publicly in multiple dump files.
Why It Matters for Trust & Control Assurance
- The incident illustrates a failure to enforce strong access‑control and monitoring around user‑profile data, a core control objective for any continuous assurance program.
- Demonstrating defensible evidence that only authorized processes can read or export user records is essential for audit readiness and to mitigate reputational risk.
Who Is Affected – Online gaming services, digital entertainment platforms, and any SaaS providers handling user‑generated content.
Recommended Actions – Review and tighten identity‑access policies for user data stores; implement continuous logging and real‑time alerts for bulk data extraction; collect and retain evidence of these controls for audit purposes. Source: Have I Been Pwned – Everybody Edits breach
Technical Notes – The breach details do not disclose a specific exploit; the exposure likely resulted from inadequate authentication or insufficient segregation of duties on the user database. No CVE is associated. Source: same as above