GoldSilver Data Breach Exposes 242,715 Customer Records Including SSNs and Partial Credit Card Data
What Happened – In October 2018 the bullion‑education and dealer‑services site GoldSilver suffered a data breach that released the personal information of 242,715 accounts. Exposed data included names, addresses, phone numbers, email addresses, purchase history, security‑question answers (MD5‑hashed), passport numbers, Social Security numbers, partial credit‑card data and bank‑account numbers. The breach files and source code were posted on a dark‑web forum and remained accessible for months.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous monitoring of data‑protection controls and evidence that encryption, hashing and access‑restriction policies are enforced.
- Highlights the importance of a documented incident‑response program that can produce a defensible audit trail when personal data is exposed.
- Aligns with the control objective of “protecting data at rest and in transit” – a single control that maps to many frameworks (e.g., NIST CSF 2.0, ISO 27001, GDPR).
Who Is Affected – Financial‑services retailers, precious‑metal dealers, e‑commerce platforms handling sensitive PII.
Recommended Actions
- Conduct a gap analysis of data‑encryption, hashing, and access‑control mechanisms against your framework of record.
- Update incident‑response playbooks to include evidence‑collection steps for breach notification and audit readiness.
- Replace weak MD5 hashing with a modern KDF (e.g., bcrypt, Argon2) for security‑question answers.
- Verify that all stored payment data is tokenized or fully encrypted and that only necessary fields are retained.
Source: Have I Been Pwned – GoldSilver breach
Technical Notes
- Attack vector not disclosed; breach appears to involve unauthorized access to source code and database dumps.
- Data types exposed: bank‑account numbers, email addresses, IP addresses, names, partial credit‑card data, passport numbers, phone numbers, physical addresses, purchase records, security‑question answers (MD5 hashes), Social Security numbers.
Source: same as above