LimeVPN Breach Exposes 23,348 Customer Records
What Happened
In October 2020 the VPN service LimeVPN suffered a data breach that released the personal information of 23,348 accounts. The exposed data set includes email addresses, IP addresses, full names, phone numbers, physical addresses, purchase histories, and passwords stored as salted MD5 hashes.
Why It Matters for Compliance & Audit Readiness
- Demonstrates the need for continuous control‑assurance over third‑party authentication data stores, not just periodic vendor questionnaires.
- Highlights the importance of verifying that encryption and hashing practices meet current NIST 800‑63B standards; weak salted MD5 hashes are a control gap.
- Shows how a documented incident‑response and evidence‑preservation process can reduce audit findings when a breach involves personal data.
Who Is Affected
- VPN service providers and their downstream customers.
- Enterprises that rely on LimeVPN for remote‑work connectivity.
- Any organization that stored employee or customer credentials with the provider (e.g., SaaS platforms, e‑commerce sites).
Recommended Actions
- Inventory all services that consume LimeVPN and assess exposure of the listed data fields.
- Validate that password storage uses modern, memory‑hard hashing (e.g., Argon2, bcrypt) and re‑hash any MD5‑derived credentials.
- Review and update third‑party risk controls, ensuring continuous monitoring of vendor security posture.
- Request a detailed incident‑response report from LimeVPN and confirm that forensic evidence has been preserved for audit purposes.
Technical Notes
- Attack vector: Unauthorized access to the user database (exact method not disclosed).
- CVEs: None reported in the public breach notice.
- Data types exposed: Email addresses, IP addresses, full names, phone numbers, physical addresses, purchase histories, passwords (salted MD5 hashes).
Source: https://haveibeenpwned.com/api/v3/breach/LimeVPN