Mac‑Torrents Breach Exposes 93,992 User Accounts and Weakly‑Hashed Passwords
What Happened — In October 2015 the public‑facing torrent site mac‑torrents.com was compromised. Attackers extracted a database containing 93,992 usernames, email addresses and passwords. The passwords were stored as unsalted MD5 hashes, making them trivially crackable.
Why It Matters for Trust & Control Assurance
- Weak credential storage is a classic control gap that a continuous‑control‑assurance program is built to detect and remediate.
- Demonstrating defensible evidence of strong password‑hashing practices satisfies a core access‑control objective across multiple frameworks.
- The breach underscores the need for ongoing monitoring of credential‑management controls and audit‑ready documentation of hashing algorithms.
Who Is Affected — Primarily users of the Mac‑Torrents platform (media/entertainment‑focused web service). Any individuals who reused these credentials on other services are also at risk.
Recommended Actions
- Require all affected users to reset passwords immediately and enforce multi‑factor authentication where possible.
- Replace MD5 hashing with a modern, salted algorithm such as bcrypt, Argon2, or PBKDF2.
- Conduct a credential‑storage audit, capture evidence of hashing methods, and map findings to your control‑assurance framework.
- Implement continuous monitoring of password‑policy compliance and retain verifiable logs for audit readiness.
Source: Have I Been Pwned – Mac‑Torrents breach
Technical Notes
- Attack vector not publicly disclosed; breach appears to be a classic web‑application compromise.
- Data exposed: email addresses, usernames, passwords (MD5‑hashed, no salt).
Source: same as above