Foodora Data Breach Exposes 582,578 Customer Records and Password Hashes
What Happened — In April 2016 the online food‑delivery platform Foodora suffered a breach that released the personal data of 582,578 customers. The leaked dataset contained names, email addresses, phone numbers, physical delivery addresses, and password hashes stored as salted MD5 or bcrypt.
Why It Matters for Trust & Control Assurance
- The incident illustrates a failure to enforce strong credential‑storage controls—an area continuous control‑assurance programs monitor and evidence.
- It demonstrates the audit value of maintaining defensible proof that password hashing meets industry‑accepted standards (e.g., salted bcrypt).
- A breach of this type triggers multiple regulatory notice‑and‑remediation obligations; documented controls help prove due‑diligence.
Who Is Affected – Retail & e‑commerce operators, food‑delivery services, and any organization that stores customer credentials for online ordering.
Recommended Actions –
- Review and upgrade password‑storage algorithms to a modern, memory‑hard function (e.g., Argon2).
- Implement continuous monitoring of credential‑management controls and retain evidence for audit readiness.
- Conduct a gap analysis against the “Secure Authentication” control objective and map findings to your framework of record (e.g., NIST CSF 2.0 Protect function).
Technical Notes – The breach appears to stem from insecure hashing (salted MD5) and possibly a mis‑configuration that allowed the credential database to be accessed. No specific CVE is cited. Source: Have I Been Pwned – Foodora breach