20.7 M Customer Records Exposed in Hurb Travel Agency Data Breach
What Happened – In March 2019 the Brazilian online travel agency Hurb (formerly Hotel Urbano) suffered a data breach that exposed 20,727,771 customer records. The leaked data, later posted for download, included email addresses, IP addresses, names, dates of birth, phone numbers, social‑media profile links and passwords stored as unsalted MD5 hashes.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of weak credential‑storage controls – a core element of any continuous control‑assurance program.
- Highlights the need for auditable evidence that password‑hashing algorithms meet industry‑accepted standards (e.g., salted bcrypt/argon2).
- Shows how a single credential‑management gap can generate a large‑scale data‑exposure incident, triggering regulatory and audit scrutiny.
Who Is Affected – Travel‑and‑hospitality online booking platforms, SaaS providers handling consumer data, and any organization that stores passwords without proper hashing.
Recommended Actions
- Conduct an immediate inventory of password‑storage mechanisms and replace unsalted MD5 with a modern, salted algorithm (bcrypt, scrypt, argon2).
- Enforce multi‑factor authentication for all privileged and customer‑facing accounts.
- Implement continuous monitoring of credential‑storage configurations and generate defensible audit evidence for credential‑protection controls.
Technical Notes – The breach appears to have resulted from insecure password hashing (unsalted MD5) and possibly inadequate access controls on the underlying database. No specific CVE was disclosed. Source: https://haveibeenpwned.com/api/v3/breach/Hurb