JD.com Exposes 77 Million Accounts in 2013 Data Breach – Emails, Password Hashes, Phone Numbers
What Happened — In 2013, JD.com’s e‑commerce platform was breached, leaking 13 GB of data that included 77,449,341 unique email addresses, usernames, phone numbers and passwords stored as SHA‑1 hashes.
Why It Matters for Trust & Control Assurance
- Weak hashing (SHA‑1) violates modern credential‑storage controls and can trigger audit findings across multiple frameworks.
- Continuous monitoring of credential exposure provides defensible evidence that an organization is actively managing this risk.
- A single breach affecting tens of millions demonstrates the audit‑readiness value of documented remediation and control‑mapping.
Who Is Affected — Retail and online marketplace operators that store customer credentials, as well of any service handling large volumes of personal data.
Recommended Actions
- Replace SHA‑1 hashes with salted bcrypt, Argon2, or an equivalent strong algorithm.
- Deploy continuous credential‑exposure monitoring (e.g., HaveIBeenPwned feeds) and retain logs as audit evidence.
- Map the credential‑storage control to your framework of record and document remediation steps. Source: Have I Been Pwned – JD breach
Technical Notes — Attack vector remains unknown; data was stored as SHA‑1 password hashes, a cryptographically weak method. The breach was discovered through public breach reporting. Source: Have I Been Pwned – JD breach