FaceUP Social Media Site Breach Exposes 87,633 User Records
What Happened – In 2013 the Danish social‑media platform FaceUP was compromised through a SQL‑injection flaw. Attackers extracted 87,633 accounts that contained email addresses, names, dates of birth, genders, phone numbers, usernames and passwords stored as unsalted MD5 hashes. FaceUP responded by forcing password resets for the affected users.
Why It Matters for Trust & Control Assurance
- Continuous vulnerability monitoring would have flagged the SQL‑injection weakness before it was exploited, providing evidence for a robust control‑assurance program.
- Documented remediation (password resets, code fixes) creates a defensible audit trail that satisfies multiple framework requirements.
- Secure credential storage (salted, strong hashing) is a core control that demonstrates due diligence in protecting personal data.
Who Is Affected – Social‑media platforms, consumer‑facing web applications, and any service that stores personally identifiable information (PII) and authentication credentials.
Recommended Actions
- Conduct a comprehensive code review to identify and remediate injection vulnerabilities.
- Upgrade password storage to salted, computationally‑hard hashing algorithms (e.g., bcrypt, Argon2).
- Capture remediation steps and monitoring evidence in a continuous control‑assurance repository to support audit readiness. Source: https://haveibeenpwned.com/api/v3/breach/FaceUP
Technical Notes – Attack vector: SQL injection exploiting a vulnerable query endpoint. Data types exposed: email, name, date of birth, gender, phone number, username, and passwords (unsalted MD5). Source: https://haveibeenpwned.com/api/v3/breach/FaceUP