EyeEm Breach Exposes 19.6 M User Accounts and Password Hashes
What Happened — In February 2018 the photography platform EyeEm suffered a data breach that exposed approximately 19.6 million user records, including email addresses, names, usernames, bios, and password hashes.
Why It Matters for Trust & Control Assurance
- The incident illustrates a failure to protect credential data—a core control objective for identity and access management that continuous‑control‑assurance programs are built to monitor and evidence.
- Demonstrable logging of privileged access and timely incident response are essential to provide a defensible audit trail after a credential‑related breach.
- Verisq’s Access Controls capability helps organizations collect, map, and continuously verify evidence that credential‑management controls are operating as intended.
Who Is Affected — Consumer‑focused media and SaaS platforms that store user‑generated content and authentication data.
Recommended Actions
- Conduct an immediate credential‑management review: enforce strong password policies, enable MFA, and rotate compromised passwords.
- Verify that logging of authentication events is comprehensive and retained for audit purposes.
- Update incident‑response playbooks to include rapid containment and forensic analysis of credential leaks. Source: https://haveibeenpwned.com/api/v3/breach/EyeEm
Technical Notes — The breach released password hashes along with personal identifiers; the exact exploitation vector was not disclosed. No specific CVE is associated. Source: https://haveibeenpwned.com/api/v3/breach/EyeEm