Hemmakväll Video Store Chain Breach Exposes 47,297 Customer Records, Including Weakly Hashed Passwords
What Happened — In July 2015 the Swedish video‑store chain Hemmakväll was hacked. Approximately 47 k customer records were dumped publicly, containing email addresses, full names, phone numbers, physical addresses, and passwords that were stored using a weak MD5 hash.
Why It Matters for Trust & Control Assurance
- Weak password hashing is a classic control gap that a continuous control‑assurance program should detect, remediate, and evidence.
- Demonstrating robust credential protection (e.g., salted strong hashes) provides defensible audit evidence for data‑protection controls across multiple frameworks.
- Ongoing monitoring of credential‑storage practices helps maintain a trusted posture and reduces the risk of future data‑exfiltration incidents.
Who Is Affected — Retail and media‑entertainment organizations that collect and store customer personally identifiable information (PII), especially those relying on legacy password‑storage mechanisms.
Recommended Actions
- Replace MD5 hashing with a modern, salted algorithm such as bcrypt, scrypt, or Argon2.
- Map the credential‑storage control to your audit‑readiness framework and collect evidence of the change.
- Implement continuous monitoring of password‑policy compliance and conduct regular credential‑storage health checks. Source: Have I Been Pwned – Hemmakväll breach
Technical Notes — The breach likely stemmed from exploitation of insecure password storage (MD5) combined with inadequate access controls. Exposed data types: email, name, phone, physical address, and password hashes. Source: Have I Been Pwned – Hemmakväll breach