Evite – 100.9 M Accounts Breached, Plain‑Text Passwords Exposed
What Happened — In April 2019 Evite discovered unauthorized access to a database archive dating back to 2013. The breach exposed 100,985,047 records, including email addresses, names, phone numbers, physical addresses, dates of birth, genders, and passwords stored in plain text.
Why It Matters for Trust & Control Assurance
- The incident is a textbook case of insufficient access‑control and credential‑protection—exactly the controls a continuous assurance program monitors and evidences.
- Demonstrates the need for defensible audit trails that prove privileged‑access reviews and encryption policies are enforced.
- Highlights why organizations must maintain real‑time monitoring of database activity to detect and contain unauthorized access quickly.
Who Is Affected — Consumer‑facing web platforms, media & entertainment services that store personal data and credentials.
Recommended Actions — Review password storage practices (hashing, salting, encryption), implement privileged‑access monitoring, and collect evidence of these controls for audit readiness. Source: https://haveibeenpwned.com/api/v3/breach/Evite
Technical Notes — Attack vector: unauthorized access to a legacy database archive (exact method not disclosed). Exposed data types: email, name, phone, address, DOB, gender, and clear‑text passwords. Source: https://haveibeenpwned.com/api/v3/breach/Evite