28,641 User Accounts Exposed in Hemmelig.com Data Breach
What Happened — In December 2011, Norway’s largest online adult‑goods retailer hemmelig.com was breached by a group calling itself “Team Appunity.” The attackers exfiltrated 28,641 records containing email addresses, usernames, nicknames, gender, year of birth and unsalted MD5 password hashes.
Why It Matters for Trust & Control Assurance
- The incident highlights the risk of weak credential storage (unsalted MD5) and the need for continuous evidence that password‑hashing policies meet best‑practice standards.
- A control‑assurance program should be able to prove, at any moment, that credential protection mechanisms are enforced, monitored, and auditable.
- Demonstrable due‑diligence around data‑at‑rest encryption and hashing reduces audit findings across multiple frameworks (e.g., NIST CSF, ISO 27001).
Who Is Affected — Retail/e‑commerce operators that collect personally identifiable information and maintain user credentials, especially those handling sensitive or adult‑content services.
Recommended Actions
- Immediately replace all MD5 password hashes with a salted, computationally‑hard algorithm (e.g., bcrypt, Argon2).
- Enforce multi‑factor authentication for privileged accounts and conduct a credential‑policy review.
- Capture and retain evidence of hashing procedures, key‑rotation logs, and access‑control reviews to satisfy audit requirements.
Technical Notes — The breach exposed unsalted MD5 hashes, a legacy algorithm vulnerable to pre‑image attacks. No specific vulnerability (CVE) was disclosed; the attack vector remains unknown. Source: Have I Been Pwned – Hemmelig breach