Fantasy Football Hub Breach Exposes 66,479 User Accounts, Including Password Hashes
What Happened – In October 2021 the Fantasy Football Hub website suffered a data breach that released 66,479 unique records. Exposed data included email addresses, names, usernames, IP addresses, purchase history and passwords stored as unsalted WordPress MD5 hashes.
Why It Matters for Trust & Control Assurance
- The incident illustrates a failure to protect credential data – a core control objective for identity and access management.
- Continuous control‑assurance programs require evidence that password storage follows strong hashing standards and that access to credential stores is logged and reviewed.
- Verisq’s Access Controls capability helps you capture, monitor, and demonstrate compliance with this control across frameworks, providing a defensible audit trail.
Who Is Affected – Sports‑media/web‑application providers, online gaming platforms, and any organization that stores user credentials without strong hashing.
Recommended Actions
- Replace MD5 hashes with a modern, salted algorithm (e.g., bcrypt, Argon2).
- Enforce multi‑factor authentication for privileged accounts.
- Implement continuous monitoring of credential‑store access and retain immutable logs for audit readiness.
- Notify affected users and require password resets.
Technical Notes – The breach appears to stem from a misconfiguration that left password hashes accessible; no specific CVE was disclosed. Data types exposed: email, name, username, IP, purchase details, and MD5 password hashes. Source: Have I Been Pwned – Fantasy Football Hub