Fur Affinity Breach Exposes 1.27 M Email Addresses, Usernames, and Password Hashes
What Happened – In May 2016 the community site Fur Affinity was compromised. Attackers obtained the user database, leaking 1,270,564 records that included email addresses, usernames and hashed passwords. The breach was later disclosed through Have I Been Pwned.
Why It Matters for Trust & Control Assurance
- This incident illustrates the exact scenario a continuous control‑assurance program aims to prevent: inadequate credential protection and insufficient monitoring of access‑control failures.
- Demonstrating robust identity‑and‑access‑management (IAM) controls—strong password hashing, MFA, and real‑time audit logs—provides defensible evidence for auditors and regulators.
- Leveraging Verisq’s ACCESS_CONTROLS capability lets you continuously collect, map, and report on these controls against the Verisq Common Framework (VCF), satisfying multiple frameworks (e.g., NIST CSF 2.0) with a single control objective.
Who Is Affected – Online community platforms, hobby‑oriented social sites, and any service that stores user credentials (media/entertainment, SaaS, forums).
Recommended Actions
- Verify that password storage uses industry‑recommended hashing (e.g., Argon2, bcrypt) with unique salts.
- Deploy multi‑factor authentication for all user accounts and enforce strong password policies.
- Enable continuous monitoring of authentication logs and set alerts for anomalous login patterns.
- Document the controls in a central Trust Center to provide audit‑ready evidence.
Source: Have I Been Pwned – Fur Affinity breach
Technical Notes
- Attack vector: unknown (likely credential‑theft via web‑application compromise).
- Exposed data: email addresses, usernames, password hashes (no clear indication of hashing algorithm).
- No public evidence of ransomware or extortion.
Source: same as above