Mathway Breach Exposes 25.7 M User Accounts, Including Password Hashes
What Happened — In January 2020 the online math‑solving service Mathway suffered a data breach that released more than 25 million user records. The leaked dataset contained names, Google and Facebook identifiers, email addresses and salted password hashes, which were later posted on a dark‑web marketplace.
Why It Matters for Trust & Control Assurance
- The incident illustrates the exact scenario a continuous access‑control assurance program is built to prevent: unprotected credential stores and insufficient authentication hygiene.
- Demonstrable evidence of strong password policies, MFA enforcement, and regular credential‑access monitoring provides a defensible audit trail for frameworks such as NIST CSF 2.0.
- Ongoing verification of credential‑handling controls helps organizations prove due‑diligence to regulators and partners.
Who Is Affected – SaaS providers, education‑technology platforms, and any organization that stores user‑generated credentials at scale.
Recommended Actions – Review and harden password storage (use strong hashing, peppering), enforce multi‑factor authentication for all accounts, rotate compromised credentials, and implement continuous monitoring of credential‑access logs to generate audit‑ready evidence. Source: Have I Been Pwned – Mathway breach
Technical Notes – The breach exposed device information, email addresses, names, social‑media profile IDs and salted password hashes. No specific vulnerability (CVE) was disclosed; the attack vector remains unknown. Source: Have I Been Pwned – Mathway breach