GameSalad Breach Exposes 1.5 M User Accounts, Including Password Hashes
What Happened – In February 2019 the GameSalad platform suffered a data breach that compromised 1,506,242 user records. The exposed data set includes email addresses, usernames, IP addresses and passwords stored as SHA‑256 hashes.
Why It Matters for Trust & Control Assurance
- The incident illustrates the risk of credential exposure when password storage and authentication controls are not continuously verified.
- A robust access‑control program—covering password policies, hashing standards, and MFA enforcement—provides the evidence auditors expect for a defensible audit trail.
- Continuous monitoring of credential‑related controls helps detect gaps before they lead to large‑scale data exposure.
Who Is Affected – Education‑technology platforms, game‑creation SaaS services, and their end‑users.
Recommended Actions
- Review and strengthen password‑storage mechanisms (e.g., adopt salted, adaptive hashing).
- Enforce multi‑factor authentication for all privileged and user accounts.
- Implement continuous credential‑control monitoring and retain evidence of policy compliance for audit readiness.
Technical Notes – The breach disclosed SHA‑256 password hashes, email addresses, usernames and IP addresses. No specific vulnerability or attack vector was publicly identified. Source: [Have I Been Pwned – GameSalad breach]