MALL.cz Breach Exposes 735k Customer Accounts and Passwords
What Happened – In July 2017 the Czech e‑commerce platform MALL.cz suffered a data breach that resulted in the public release of 735,405 unique user records. The exposed data included email addresses, full names, phone numbers and password hashes; the hashes were cracked and the resulting plain‑text passwords were posted online. The breach was limited to accounts created before 2015.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of weak credential storage – a core control area that continuous‑control‑assurance programs monitor and evidence.
- Highlights the need for auditable password‑hashing policies and regular verification that hashing algorithms meet current strength standards.
- Provides a real‑world example of why organizations must maintain defensible evidence of credential‑management controls to satisfy GDPR‑style data‑protection obligations.
Who Is Affected – Online retailers and any service handling EU personal data (email, name, phone, passwords).
Recommended Actions
- Conduct a credential‑storage audit: verify that all passwords are hashed with a strong, industry‑accepted algorithm (e.g., Argon2, bcrypt, scrypt).
- Re‑hash any legacy or weak hashes and force password resets for affected accounts.
- Implement continuous monitoring of password‑policy compliance and retain evidence for audit readiness under GDPR.
- Review incident‑response documentation to ensure a clear, auditable timeline of breach detection, containment, and notification.
Technical Notes – The breach appears to stem from the use of multiple, varying‑strength hashing algorithms over time; weaker hashes were cracked, while stronger ones remained unexposed. No specific vulnerability (CVE) or attack vector was disclosed.