Hathway ISP Breach Exposes 4.7 M Customer Records
What Happened — In December 2023, hundreds of gigabytes of data allegedly taken from Indian ISP and digital‑TV provider Hathway were posted on a public hacking forum. The leak includes 4,670,080 unique email addresses together with names, physical and IP addresses, phone numbers, password hashes and support‑ticket logs.
Why It Matters for Trust & Control Assurance
- The incident illustrates the exact scenario a continuous control‑assurance program is built to detect, document and remediate: a third‑party data‑handling failure that leads to mass personal‑information exposure.
- Demonstrable evidence of vendor‑risk oversight (e.g., regular security‑posture assessments, contractual security controls, and real‑time monitoring) provides a defensible audit trail and reduces the likelihood of similar breaches.
Who Is Affected – Telecommunications and broadband providers, their downstream digital‑TV services, and the 4.7 M end‑users whose personal data were exposed.
Recommended Actions
- Map this incident to the control objective of “Third‑Party Risk Management – Ongoing Monitoring & Evidence Collection.”
- Gather evidence of existing vendor contracts, security assessments, and encryption practices; identify gaps and remediate.
- Initiate credential‑reuse monitoring for exposed password hashes and notify affected customers per applicable regulations.
Technical Notes – Exfiltrated data includes device information, email addresses, IP addresses, names, passwords (hashes), phone numbers, physical addresses, salutations, and support‑ticket logs. The exact attack vector was not disclosed. Source: Have I Been Pwned – Hathway breach