Mappery Data Breach Exposes 205,242 Accounts with Unsalted SHA‑1 Password Hashes
What Happened – In December 2018 the mapping service Mappery suffered a data breach that exposed 205,242 unique user records. The leaked data included email addresses, usernames, geographic locations, and passwords stored as unsalted SHA‑1 hashes. Mappery did not respond to inquiries from researchers or the media.
Why It Matters for Trust & Control Assurance
- Weak credential‑storage is a classic control‑gap that continuous‑control‑assurance programs are built to detect, remediate, and evidence.
- Demonstrating that passwords are hashed with modern, salted algorithms provides audit‑ready proof of a core identity‑and‑access‑management control.
- Ongoing monitoring of credential‑related controls creates a defensible trail that regulators and auditors can review.
Who Is Affected – SaaS / mapping platforms, API providers, and any organization that stores user credentials.
Recommended Actions
- Conduct an immediate audit of password‑storage mechanisms; replace unsalted SHA‑1 hashes with salted bcrypt, Argon2, or equivalent.
- Update IAM policies to require strong hashing standards and schedule periodic reviews.
- Capture and retain evidence of hashing controls (configuration snapshots, test results) for audit readiness.
Technical Notes – The breach appears to stem from a database exposure; no specific vulnerability (CVE) was disclosed. Data types leaked: email addresses, usernames, geographic locations, and password hashes (unsalted SHA‑1). Source: Have I Been Pwned – Mappery breach