Havenly breach exposes 1.37 M user accounts, passwords stored as SHA‑1 hashes
What Happened — In June 2020 the interior‑design platform Havenly suffered a data breach that released 1,369,180 user records. The exposed data included email addresses, names, phone numbers, geographic locations and passwords that were stored as unsalted SHA‑1 hashes. The compromised dataset was subsequently shared on public hacking forums and indexed by Have I Been Pwned.
Why It Matters for Trust & Control Assurance
- Weak password hashing indicates a lapse in credential‑protection controls that a continuous‑control‑assurance program would flag and remediate.
- Demonstrable evidence of strong hashing standards and monitoring of credential stores is a core control‑area that auditors look for across frameworks.
- Ongoing verification of credential‑handling policies provides a defensible audit trail and reduces the risk of future exposure.
Who Is Affected – Consumers of Havenly’s online interior‑design service (retail/e‑commerce) and any downstream partners that rely on its user data.
Recommended Actions
- Conduct an immediate review of password storage mechanisms; migrate from SHA‑1 to a modern, salted algorithm such as bcrypt or Argon2.
- Deploy continuous monitoring of credential‑storage configurations and generate evidence for audit readiness.
- Enforce multi‑factor authentication for all user accounts and perform a credential‑access review.
Technical Notes – The breach appears to stem from compromised credential storage rather than a disclosed vulnerability; no CVE is associated. Exposed data types: email, name, phone, location, and SHA‑1‑hashed passwords. Source: [Have I Been Pwned – Havenly breach]