Plain‑Text Passwords Exposed in Fridae Breach Impacting 35,368 Users
What Happened — In May 2014 the Fridae .asia social platform for LGBTQ communities suffered a breach that exposed 35,368 user records. The leaked data included email addresses, usernames, website activity, and passwords that were stored in plain text. The breach was publicly claimed by the DeleteSec group.
Why It Matters for Trust & Control Assurance
- Storing passwords in clear text violates the fundamental control objective of protecting credentials and demonstrates a gap in identity‑and‑access‑management (IAM) processes.
- Continuous control‑assurance programs require verifiable evidence that password handling follows industry‑accepted hashing and salting standards, enabling defensible audit trails.
- The incident underscores the need for real‑time monitoring of credential storage practices and rapid remediation when gaps are detected.
Who Is Affected – LGBTQ‑focused social networking services, broader SaaS platforms handling user credentials, and any organization that stores passwords without strong cryptographic protection.
Recommended Actions
- Immediately replace all plain‑text passwords with securely hashed and salted equivalents (e.g., Argon2, bcrypt).
- Enforce multi‑factor authentication (MFA) for all user accounts.
- Conduct a credential‑storage audit against the “secure credential management” control objective and document remediation steps for audit readiness.
Technical Notes – The breach appears to stem from a misconfiguration or poor development practice that left password fields unencrypted. No specific CVE is associated, but the exposure of clear‑text credentials is a classic credential‑storage vulnerability. Source: Have I Been Pwned – Fridae breach