Public Database Misconfiguration Exposes 2.1M Email Addresses and Password Hashes from MC2 Data
What Happened — In August 2024, MC2 Data left a database publicly accessible without any authentication. A security researcher discovered the open store and reported that it contained personal data for 2,122,280 subscribers, including email addresses, names, and salted SHA‑256 password hashes.
Why It Matters for Trust & Control Assurance —
- Unauthenticated public storage violates the control objective of maintaining robust access controls and configuration management.
- Continuous monitoring of cloud and on‑prem configurations provides the evidence needed to demonstrate due diligence during audits.
- Documented remediation and proof of control remediation create a defensible audit trail for frameworks that require configuration integrity.
Who Is Affected — SaaS and data‑aggregation providers; downstream customers that consume MC2 Data feeds; any organization whose users’ credentials were stored in the exposed dataset.
Recommended Actions —
- Deploy automated configuration‑drift detection for all public‑facing assets and integrate alerts into a continuous control‑assurance workflow.
- Rotate any exposed passwords and enforce multi‑factor authentication for privileged access.
- Map the misconfiguration to your control framework and capture remediation evidence for audit readiness. Source: https://haveibeenpwned.com/api/v3/breach/MC2Data
Technical Notes — The exposure resulted from a cloud‑hosted database lacking authentication; no known vulnerability (CVE) was exploited. Data types included email addresses, full names, and salted SHA‑256 password hashes. Source: https://haveibeenpwned.com/api/v3/breach/MC2Data