Lyrics Mania Breach Exposes 109,202 Usernames, Emails, and Plain‑Text Passwords
What Happened – In December 2017 the lyrics‑sharing site Lyrics Mania suffered a data breach that released 109,202 records containing usernames, email addresses and passwords stored in clear text. The breach was reported to Have I Been Pwned (HIBP) and no public response from the site was recorded.
Why It Matters for Trust & Control Assurance
- Plain‑text password exposure highlights a failure of credential‑protection controls that a continuous assurance program must monitor and evidence.
- The incident underscores the need for documented password‑hashing policies, regular credential‑storage reviews, and audit‑ready logs of access to sensitive user data.
- Demonstrating robust identity‑and‑access controls provides a defensible posture for regulators and partners evaluating trust.
Who Is Affected – Online media/entertainment platforms, consumer‑facing web services, and any organization that stores user credentials without strong cryptographic protection.
Recommended Actions
- Immediately force password resets for all affected accounts and enforce multi‑factor authentication where possible.
- Replace clear‑text storage with salted, iterated hashing (e.g., bcrypt, Argon2) and document the process as control evidence.
- Conduct a credential‑storage audit, capture evidence of the new controls, and map the findings to your audit‑readiness framework.
Technical Notes – The breach disclosed email addresses, usernames and passwords in plain text. The exact attack vector was not disclosed; the compromise is attributed to inadequate credential‑storage practices. Source: HIBP breach record