Fanlore Wiki Breach Exposes 144,520 Email Addresses, Usernames, and Password Hashes
What Happened — In August 2026 the Organization for Transformative Works discovered unauthorized access to its Fanlore wiki. Attackers obtained roughly 145 k unique email addresses, usernames, and password hashes (MD5 or PBKDF2). The compromised data were later submitted to Have I Been Pwned (HIBP).
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of weak credential storage and insufficient access‑control monitoring – a core scenario that continuous control‑assurance programs are built to detect and evidence.
- Highlights the need for defensible audit trails around password‑hashing algorithms, rotation policies, and privileged‑access reviews.
- Aligns with the Access Controls capability: verifying that identity‑management processes, hashing standards, and breach‑response evidence are continuously collected.
Who Is Affected – Media & entertainment sites, community wikis, and any organization that stores user credentials without strong hashing or robust access monitoring.
Recommended Actions
- Inventory all password‑storage mechanisms; replace weak MD5 hashes with modern, salted algorithms (e.g., Argon2).
- Enforce credential rotation for all exposed accounts and monitor for credential reuse across services.
- Implement continuous monitoring of privileged‑access logs and retain evidence for audit readiness.
Technical Notes – The breach involved unauthorized access to the wiki’s backend; the exact exploit vector was not disclosed. Exposed data include email addresses, usernames, and password hashes (MD5 or PBKDF2). Source: HIBP breach record