Kickstarter Exposes 5.2 M User Emails and Password Hashes in 2014 Breach
What Happened — In February 2014 the crowdfunding platform Kickstarter disclosed that a breach exposed 5,176,463 unique email addresses, usernames and salted SHA‑1 password hashes.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of weak credential‑storage practices; a continuous‑control‑assurance program should verify that password hashing meets current cryptographic standards.
- Highlights the need for ongoing evidence that access‑control policies (e.g., MFA, password‑complexity) are enforced and auditable.
- Provides a real‑world data point for the “credential protection” control objective that maps to dozens of framework requirements (SOC 2, ISO 27001, NIST CSF, etc.).
Who Is Affected – Technology‑SaaS providers, any organization that stores user credentials, especially platforms handling large volumes of consumer accounts.
Recommended Actions – Review and upgrade password‑hashing algorithms (e.g., migrate from SHA‑1 to bcrypt/Argon2), enforce multi‑factor authentication, conduct a credential‑storage audit, and capture evidence of the updated controls for audit readiness. Source: [Kickstarter breach notice]
Technical Notes – The breach released salted SHA‑1 hashes, which are now considered insufficient against modern cracking techniques. No specific CVE was disclosed; the incident likely stemmed from inadequate cryptographic controls. Source: [Have I Been Pwned – Kickstarter]