Gravatar – 114 Million Email Addresses, Names, and Usernames Exposed via Large‑Scale Scraping
What Happened — In October 2020 a researcher demonstrated a method to scrape Gravatar’s public avatar service at scale. Approximately 167 million records (email‑address MD5 hashes, names, usernames) were harvested; 114 million of those hashes were cracked, revealing the underlying email addresses and associated data. The compromised data was later published and indexed by Have I Been Pwned.
Why It Matters for Trust & Control Assurance
- Unrestricted public endpoints allow mass data collection, a scenario continuous control‑assurance programs aim to detect and restrict through access‑control policies and anomalous‑activity monitoring.
- Demonstrates the need for defensible audit evidence (e.g., rate‑limit logs, API usage reports) that you can produce to regulators or auditors showing you’ve mitigated similar exposure risks.
- Highlights the importance of ongoing third‑party risk oversight: even a widely‑used service must be vetted for proper data‑access safeguards.
Who Is Affected
- SaaS platforms and websites that embed Gravatar avatars (e.g., WordPress sites).
- End‑users whose email addresses, names, and usernames were disclosed.
Recommended Actions
- Review any third‑party avatar or image services for rate‑limiting, authentication, and logging controls.
- Implement continuous monitoring of outbound API calls and anomalous request patterns.
- Conduct a privacy impact assessment for any data sourced from public APIs and update data‑handling policies accordingly.
- Collect and retain evidence of these controls (configuration snapshots, log archives) for audit readiness.
Technical Notes – The attack leveraged a publicly accessible endpoint without authentication, combined with MD5 hash cracking to reverse‑engineer email addresses. No specific CVE was issued; the issue resides in service design rather than a software flaw. Source: https://haveibeenpwned.com/api/v3/breach/Gravatar