Horse Isle Breach Exposes 27,786 Accounts with Plain‑Text Passwords
What Happened — In June and September 2020 the online game Horse Isle suffered two data exposures that released 27,786 user records. The dump contained email addresses, names, usernames, IP addresses, genders, purchase histories and passwords stored in plain text, along with failed login attempts.
Why It Matters for Trust & Control Assurance —
- The incident reveals a missing control around secure credential storage, a core area that continuous‑control‑assurance programs monitor and evidence.
- Without salted hashing and immutable authentication logs, organizations cannot produce a defensible audit trail for frameworks such as NIST CSF 2.0.
- A single credential‑handling gap can cascade into data‑exposure violations across multiple compliance regimes.
Who Is Affected — Online gaming platforms, SaaS services that manage user authentication, and any organization that stores passwords.
Recommended Actions —
- Replace plain‑text storage with salted hashing (e.g., bcrypt, Argon2).
- Conduct a credential‑storage audit and map findings to the “secure credential storage” control objective.
- Enable immutable logging of all authentication events for forensic readiness.
- Refresh security‑awareness training to reinforce password best practices. Source: https://haveibeenpwned.com/api/v3/breach/HorseIsle
Technical Notes — The breach appears to stem from insecure storage (misconfiguration) rather than an exploited vulnerability. Exposed data types: email, name, username, IP, gender, purchase history, and plain‑text passwords. Source: https://haveibeenpwned.com/api/v3/breach/HorseIsle