LegionProxy Proxy Service Breach Exposes 10,144 Accounts
What Happened
In April 2026 the commercial residential and ISP proxy network operated by LegionProxy suffered a breach that released data for 10,144 user accounts. The exposed records include email addresses, full names, bcrypt password hashes, and purchase history.
Why It Matters for Compliance & Audit Readiness
- Demonstrates the need for continuous control‑assurance over third‑party proxy services that handle authentication credentials.
- Highlights the importance of documented evidence that encryption, hashing, and credential‑rotation policies are enforced and regularly verified.
- Serves as a test case for incident‑response documentation and breach‑notification obligations under GDPR, CCPA, and industry‑specific regulations.
Who Is Affected
- Providers of residential and commercial proxy services
- Internet Service Providers that embed proxy offerings
- Enterprises that rely on LegionProxy for traffic routing or anonymity
- End‑users whose personal and purchase data were stored in the service
Recommended Actions
- Inventory all connections to LegionProxy and assess the necessity of continued use.
- Verify that password‑hashing algorithms (bcrypt) are implemented with appropriate work factors and that credential rotation policies are enforced.
- Activate monitoring alerts for credential‑theft indicators and review logs for suspicious authentication attempts.
- Request a detailed incident‑response report from LegionProxy and confirm their breach‑notification timeline.
- Update third‑party risk assessments and ensure evidence of controls is stored for audit purposes.
Technical Notes
- Attack vector: Likely unauthorized access to the credential store; specific exploitation method not disclosed.
- CVEs: None reported in the public disclosure.
- Data types exposed: Email addresses, full names, bcrypt password hashes, purchase transaction details.
Source: https://haveibeenpwned.com/api/v3/breach/LegionProxy