28.5 M HauteLook Accounts Exposed in 2018 Data Breach
What Happened — In mid‑2018 the fashion‑shopping site HauteLook suffered a breach that resulted in the exposure of 28,510,459 user records. The data set, later posted for sale in early‑2019, contained email addresses, names, genders, dates of birth, geographic locations and passwords stored as bcrypt hashes.
Why It Matters for Trust & Control Assurance
- Continuous monitoring of credential‑storage controls is essential; a lapse can lead to massive personal‑data exposure.
- Maintaining defensible evidence that passwords are salted and hashed satisfies audit‑readiness for multiple frameworks.
- Demonstrable oversight of access‑control policies helps prove due‑diligence during third‑party assessments.
Who Is Affected — Retail and e‑commerce customers whose personal data were stored on HauteLook.
Recommended Actions
- Verify that all passwords use strong, salted hashing (e.g., bcrypt or Argon2) and rotate any potentially compromised credentials.
- Deploy mandatory multi‑factor authentication and enforce regular password changes.
- Enable detailed credential‑access logging and feed it into a SIEM for continuous monitoring.
- Map credential‑protection controls to your audit framework and collect evidence of compliance.
Technical Notes — The breach involved the theft of a database containing bcrypt‑hashed passwords along with PII (DOB, gender, location). No specific vulnerability was disclosed; the compromise appears to stem from inadequate access controls or credential‑management practices. Source: Have I Been Pwned – HauteLook breach