Famm Photo‑Sharing Service Breach Exposes 535,240 Accounts
What Happened — In late 2020 the Japanese family‑photos website Famm suffered a data breach that released 535,240 unique email addresses along with names, dates of birth, genders and passwords stored as SHA‑256 hashes.
Why It Matters for Trust & Control Assurance
- The incident illustrates the risk of inadequate credential‑storage controls, a core area that continuous control‑assurance programs monitor and evidence.
- Demonstrates the need for defensible audit trails around access to sensitive personal data and hashing practices.
- Highlights why organizations must regularly validate that their identity‑and‑access policies (e.g., MFA, salted hashing) are enforced and documented.
Who Is Affected — Consumer‑focused web platforms that store personal photos and associated user profiles (media/entertainment sector).
Recommended Actions
- Map the breach to the control objective of “protecting credentials and personal data” and verify that hashing, salting, and key‑management meet best‑practice standards.
- Implement multi‑factor authentication for all user accounts and enforce password‑strength policies.
- Deploy continuous monitoring to detect unauthorized access to credential stores and retain immutable logs for audit readiness.
Source: Have I Been Pwned – Famm breach
Technical Notes
- Exposed data: email addresses, names, dates of birth, genders, and password hashes (SHA‑256).
- No specific vulnerability (CVE) disclosed; breach vector not publicly identified.
Source: Have I Been Pwned – Famm breach