InterPals Breach Exposes 3.44M User Accounts Including Password Hashes
What Happened — In late 2015 the online pen‑pal site InterPals was hacked, resulting in the exposure of 3,439,414 user records. The leaked data comprised email addresses, names, birthdates, geographic locations, usernames and salted password hashes.
Why It Matters for Trust & Control Assurance —
- The incident shows the risk of inadequate credential protection and the need for continuous monitoring of authentication controls.
- Demonstrates why organizations must maintain defensible evidence of password‑storage policies and access‑log reviews to satisfy audit requirements.
- Highlights the importance of a control‑assurance program that can quickly surface gaps in identity‑and‑access safeguards.
Who Is Affected — Social‑networking and online‑community platforms; the 3.4 M users whose personal data was disclosed.
Recommended Actions —
- Review password‑hashing algorithms, enforce multi‑factor authentication, and rotate salts regularly.
- Deploy continuous access‑log monitoring and retain evidence to support credential‑control objectives during audits.
Technical Notes — Attack vector not publicly disclosed; data types exposed include email, name, DOB, location, username and salted password hashes. Source: Have I Been Pwned