SQL Injection Breach Exposes 2.19M Plain‑Text Credentials from i‑Dressup Social Site
What Happened — In June 2016 the teen‑focused social site i‑Dressup was compromised via an unpatched SQL‑injection flaw. Attackers extracted more than 2,191,565 user records, including email addresses and passwords that were stored in plain text.
Why It Matters for Trust & Control Assurance
- Continuous control‑assurance programs must verify that application‑level vulnerabilities are identified, patched, and documented, providing a defensible audit trail.
- Evidence of remediation (e.g., code changes, test results) is essential to demonstrate due‑diligence in vulnerability management.
- Mapping secure‑development controls to a common framework lets organizations prove they meet multiple regulatory expectations with a single control objective.
Who Is Affected — Social networking platforms, teen‑oriented web services, and any SaaS that handles user credentials.
Recommended Actions
- Conduct a full application‑security assessment focused on injection vectors.
- Replace plain‑text password storage with strong hashing (e.g., bcrypt, Argon2).
- Document remediation steps and collect evidence for continuous control mapping.
- Integrate automated vulnerability scanning into your assurance workflow to maintain real‑time evidence of compliance.
Technical Notes — Attack vector: exploitation of a SQL‑injection vulnerability; data types exposed: email addresses and passwords stored in clear text. Source: [Have I Been Pwned – i‑Dressup breach]