Flash Flash Revolution Breach Exposes 1.86 M User Accounts
What Happened – In July 2019 the rhythm‑game service Flash Flash Revolution was compromised, leaking 1,858,124 user records. The disclosed data set contained email addresses, IP addresses, usernames, dates of birth, and salted MD5 password hashes. The breach material was later shared on the public “dehashed.com” platform.
Why It Matters for Trust & Control Assurance
- The incident is a textbook example of why continuous monitoring of credential‑storage controls is a core control‑assurance requirement.
- Demonstrable evidence that password‑hashing algorithms meet modern standards (e.g., bcrypt, Argon2) is essential for a defensible audit trail across frameworks.
- Ongoing verification of access‑control policies and logging provides the documentation needed to prove due‑diligence to regulators and partners.
Who Is Affected – Gaming and entertainment platforms, any online service that stores user credentials and personal identifiers.
Recommended Actions
- Replace MD5‑based password hashes with a memory‑hard algorithm and enforce password‑policy updates.
- Deploy continuous monitoring of credential‑storage controls and retain logs as audit evidence.
- Conduct a control‑mapping exercise against the Verisq Common Framework (VCF) objective for “Password Protection” and remediate gaps.
Technical Notes – The breach vector was not publicly disclosed; the exposure appears to stem from inadequate protection of stored credential hashes. Data types exposed: email, IP, username, date of birth, salted MD5 password hashes. Source: [Have I Been Pwned API]