Fanlore Wiki Breach Exposes 144,520 Email Addresses and Password Hashes
What Happened — In August 2026 the Organization for Transformative Works (OTW) discovered unauthorized access to its Fanlore wiki. The intrusion leaked 144,520 unique email addresses, usernames and password hashes stored as MD5 or PBKDF2. OTW self‑submitted the compromised data to Have I Been Pwned.
Why It Matters for Compliance & Audit Readiness
- SOC 2 access‑control criteria (CC6.1) require documented password‑policy enforcement and MFA; this breach shows the audit risk when those controls are absent or not evidenced.
- Continuous monitoring of credential stores and breach‑response evidence is essential to produce a defensible audit trail for auditors.
- The incident highlights the need for a formal incident‑response program that captures remediation steps as audit‑ready evidence.
Who Is Affected — Community‑driven media platforms, non‑profit cultural organizations, and any service that stores user credentials in legacy hash formats.
Recommended Actions —
- Upgrade password storage to a modern, salted algorithm (e.g., Argon2).
- Enforce mandatory two‑factor authentication for all accounts and record the control in your SOC 2 evidence repository.
- Refresh incident‑response playbooks to include credential‑leak notification, evidence collection, and post‑mortem documentation. Source: https://haveibeenpwned.com/Breach/Fanlore
Technical Notes — The breach exposed email addresses, usernames, and password hashes stored as MD5 (weak) or PBKDF2 (moderate). No specific CVE is associated; the vector appears to be unauthorized access, likely due to insufficient access‑control safeguards. Source: https://haveibeenpwned.com/Breach/Fanlore