Flat Earth Sun, Moon and Zodiac App Exposes 33,294 User Records Including Plain‑Text Passwords
What Happened — In October 2024 the Flat Earth Dave astrology app inadvertently made a dataset of 33,294 user accounts publicly accessible. The dump contained email addresses, usernames, geographic coordinates, dates of birth, genders, names and, critically, passwords stored in clear text.
Why It Matters for Trust & Control Assurance
- Storing credentials without cryptographic hashing violates the core control objective of secure credential management—a requirement across SOC 2, ISO 27001, NIST CSF and many other frameworks.
- Continuous‑control‑assurance programs are designed to detect such mis‑configurations before they become a breach, providing defensible evidence that credential‑handling policies are enforced.
- The incident underscores the need for real‑time monitoring of data‑at‑rest protections and documented remediation steps that can be presented during audits or third‑party assessments.
Who Is Affected – Consumer‑focused mobile and web applications that collect personal data, especially those handling authentication credentials.
Recommended Actions
- Immediately replace all plain‑text passwords with salted, iterated hashes (e.g., Argon2, bcrypt).
- Enforce password rotation for all affected users and notify them of the breach per applicable privacy regulations.
- Deploy continuous monitoring of credential storage configurations and integrate evidence collection into your audit‑readiness workflow.
- Review and update your data‑protection policies to include encryption‑at‑rest requirements for all personally identifiable information.
Source: Have I Been Pwned – Flat Earth Dave breach details
Technical Notes – The breach appears to stem from a misconfiguration that left a database endpoint exposed and passwords stored in clear text. No specific CVE is associated, but the exposure includes PII (DOB, gender, location) and authentication secrets.