13.2 M User Accounts Compromised in Hjedd Adult Site Breach
What Happened — In July 2022 the Chinese‑operated adult‑content site hjedd.com suffered a data breach that exposed 13,204,029 user records. The leaked data, posted on a public hacking forum, included email addresses, IP addresses, usernames and password hashes (bcrypt).
Why It Matters for Trust & Control Assurance
- The incident illustrates a failure to enforce strong credential‑storage controls and to continuously verify that password‑hashing mechanisms remain robust.
- Continuous control‑assurance programs require documented evidence that access‑control policies (e.g., hashing standards, MFA for privileged accounts) are enforced and regularly audited.
- Demonstrating compliance with the “protect” function of NIST CSF 2.0 hinges on having defensible proof that credential protection controls are in place and monitored.
Who Is Affected – Online service providers, especially consumer‑facing web platforms handling credential data (e.g., adult‑entertainment sites, SaaS portals).
Recommended Actions –
- Verify that all stored passwords use current, industry‑recommended hashing algorithms (e.g., bcrypt with appropriate work factor) and document the configuration.
- Deploy multi‑factor authentication for all administrative and privileged accounts.
- Implement continuous monitoring for credential‑theft indicators and retain audit logs of access‑control changes.
- Conduct a post‑breach impact assessment and update the incident‑response playbook.
Source: Have I Been Pwned – Hjedd breach
Technical Notes – The breach appears to have resulted from a compromise of the web application’s authentication store; no specific CVE was disclosed. Exfiltrated data included bcrypt password hashes, which, while salted, may still be vulnerable to offline cracking if the work factor is insufficient.
Source: HIBP breach details