Imgur Breach Exposes 1.75 Million Email Addresses and Passwords
What Happened — In September 2013 Imgur’s user database was compromised; the stolen data resurfaced in November 2017, revealing 1,749,806 email addresses and passwords. Although passwords were stored as SHA‑256 hashes, the breach dump contained clear‑text passwords, indicating that the hashes had been cracked. Imgur migrated to bcrypt hashing in 2016, after the breach was discovered.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of weak credential‑storage controls and the need for continuous verification that hashing algorithms meet current best‑practice standards.
- Highlights the importance of maintaining an auditable trail of credential‑management changes (e.g., hash‑algorithm upgrades) for regulators and auditors.
- Shows how a lapse in password protection can become evidence of insufficient control monitoring, a core scenario that a continuous control‑assurance program is built to detect and remediate.
Who Is Affected – Online image‑sharing platforms, SaaS providers, and any organization that stores user credentials without strong, salted hashing.
Recommended Actions
- Review and upgrade all password‑storage mechanisms to a memory‑hard, salted algorithm such as bcrypt or Argon2.
- Implement continuous monitoring of credential‑storage configurations and generate periodic evidence for audit readiness.
- Conduct credential‑reuse checks for affected users and enforce mandatory password resets.
- Document the change‑management process for hashing upgrades to provide a defensible audit trail.
Technical Notes – The breach stemmed from a credential‑cracking attack against SHA‑256 hashes that lacked salting, resulting in plaintext password exposure. No public CVE is associated; the issue is a weak cryptographic practice rather than a software flaw. Source: Have I Been Pwned – Imgur breach