LiveJournal Breach Exposes 26.3 M User Credentials
What Happened
In mid‑2019 a breach affecting LiveJournal was disclosed, later confirmed by the Have I Been Pwned (HIBP) database. The incident dates to 2017 and includes 26,372,781 unique usernames, email addresses and plain‑text passwords. An archive of the compromised data was posted on a hacking forum in May 2020 and has been widely redistributed.
Why It Matters for Compliance & Audit Readiness
- Demonstrates the risk of unencrypted credential storage – a control gap that continuous monitoring and secure credential management can detect and remediate.
- Highlights the need for defensible evidence of credential rotation and MFA adoption to satisfy audit requirements such as SOC 2, ISO 27001, and NIST CSF PR‑AT.
- Serves as a real‑world example of why a trust‑and‑control‑assurance program must document credential‑handling policies and verify their enforcement across all third‑party services.
Who Is Affected
- Online publishing and community platforms (blogging, forum, social‑media services).
- Any organization that allowed users to reuse LiveJournal credentials for single sign‑on or password‑reset flows.
- End‑users whose personal email addresses and passwords were exposed.
Recommended Actions
- Review all integrations that accept LiveJournal credentials and assess exposure.
- Validate that password storage follows industry‑standard hashing (e.g., bcrypt, Argon2) and that plaintext passwords are not retained.
- Request a detailed incident‑response disclosure from LiveJournal and verify remediation steps.
- Prompt affected users to reset passwords and enable multi‑factor authentication where possible.
Technical Notes
- Attack vector: Unauthorized access to backend user database; data later exfiltrated and shared on a hacking forum.
- CVEs: None reported directly for this breach.
- Data types exposed: Email addresses, usernames, plain‑text passwords.
Source: https://haveibeenpwned.com/api/v3/breach/LiveJournal