Kaneva Breach Exposes 3.9M User Accounts Including Weak Password Hashes
What Happened — In July 2016 the now‑defunct virtual‑world platform Kaneva suffered a data breach that exposed 3,901,179 user records. The leaked data comprised email addresses, usernames, dates of birth and salted MD5 password hashes.
Why It Matters for Trust & Control Assurance —
- Credential‑storage weaknesses are a classic control‑objective failure that continuous assurance programs are built to detect and remediate.
- Evidence of strong hashing, rotation, and monitoring is essential for a defensible audit trail.
- The incident demonstrates the need for ongoing credential‑risk oversight, a core capability of Verisq’s Access Controls offering.
Who Is Affected — Online gaming and virtual‑world SaaS providers; any service that stores user credentials.
Recommended Actions — Review and upgrade password‑hashing algorithms, implement continuous monitoring of credential‑storage controls, document hashing policies as audit evidence, and reset passwords for impacted accounts. Source: https://haveibeenpwned.com/api/v3/breach/Kaneva
Technical Notes — The breach released salted MD5 hashes, which are considered cryptographically weak and vulnerable to offline cracking. No specific vulnerability or CVE was disclosed. Source: https://haveibeenpwned.com/api/v3/breach/Kaneva