Fotolog Data Breach Exposes 16.7 M Accounts
What Happened – In December 2018 the photo‑sharing site Fotolog suffered a breach that released 16,717,854 unique email addresses, usernames, and unsalted SHA‑256 password hashes. The service was shut down in 2019 and later relaunched as a news portal.
Why It Matters for Trust & Control Assurance
- The incident shows the risk of storing credential data without proper salting or key‑stretching – a control gap that a continuous‑monitoring program is designed to detect and remediate.
- Demonstrable evidence that password policies, hashing standards, and credential‑access logs are enforced satisfies the “Protect” function of NIST CSF 2.0 and provides a defensible audit trail.
- Ongoing third‑party assurance (e.g., Verisq’s Access‑Control capability) helps prove due diligence to regulators and partners after a large‑scale exposure.
Who Is Affected – Social‑media platforms, online community services, and any organization that stores user credentials in a similar fashion.
Recommended Actions
- Immediately replace unsalted SHA‑256 hashes with a modern, salted, adaptive KDF (e.g., Argon2id).
- Enforce multi‑factor authentication for all user accounts and privileged access.
- Deploy continuous credential‑storage monitoring to capture hashing algorithm changes, access logs, and anomalous extraction attempts.
- Map these controls to your audit framework and collect evidence for readiness reviews.
Source: Have I Been Pwned – Fotolog breach
Technical Notes – The breach exposed email addresses, usernames, and raw SHA‑256 password hashes that were not salted, making offline cracking feasible. No specific CVE is associated; the root cause appears to be inadequate credential‑storage practices. Source: same as above