Funimation Breach Exposes 2.5 M User Accounts, Including Password Hashes and DOB
What Happened — In July 2016 the anime streaming platform Funimation suffered a data breach that compromised approximately 2.5 million user records. The exposed data set included usernames, email addresses, dates of birth, and salted SHA‑1 password hashes.
Why It Matters for Trust & Control Assurance
- The incident illustrates the risk of inadequate credential protection—a core control area that continuous‑monitoring programs must verify and evidence.
- Demonstrating robust identity‑and‑access controls (e.g., strong password hashing, MFA, credential rotation) provides defensible audit evidence across multiple frameworks.
- Ongoing vendor‑risk oversight that captures breach notifications helps maintain a trustworthy posture for downstream partners and regulators.
Who Is Affected – Media & entertainment companies that operate consumer‑facing accounts; any organization that stores personal identifiers and password hashes.
Recommended Actions –
- Review password storage mechanisms; migrate from SHA‑1 to a modern, memory‑hard KDF (e.g., Argon2).
- Enforce multi‑factor authentication for all user logins and privileged access.
- Incorporate breach‑notification feeds into your continuous control‑assurance platform to surface credential‑related incidents promptly.
Source: Have I Been Pwned – Funimation breach
Technical Notes – The breach disclosed salted SHA‑1 hashes, which are considered weak against modern cracking techniques. No specific vulnerability or attack vector was publicly identified. Source: same as above