MEO Face Mask Company Breach Exposes 8,227 Customer Records and MD5 Password Hashes
What Happened – In early 2023 a data set originating from the New Zealand‑based face‑mask retailer MEO was discovered on HaveIBeenPwned. The archive, dated back to December 2020, contained 8,227 customer records with names, physical and email addresses, phone numbers, usernames, purchase details, and passwords stored as unsalted MD5 WordPress hashes. MEO did not respond to multiple breach‑reporting attempts.
Why It Matters for Trust & Control Assurance
- Weak password hashing (MD5) violates best‑practice credential‑storage controls and creates a gap that continuous monitoring must surface.
- Exposure of personally identifiable information (PII) demonstrates the need for documented evidence of data‑handling controls and audit‑ready remediation.
- Detecting and responding to credential leaks is a core objective of an access‑control assurance program, enabling defensible evidence for regulators and auditors.
Who Is Affected – Retail/E‑commerce organizations handling consumer PII, especially those using legacy CMS platforms (e.g., WordPress) for customer accounts.
Recommended Actions
- Replace MD5 hashes with a modern, salted algorithm such as bcrypt or Argon2.
- Deploy credential‑monitoring services to alert on exposed passwords and enforce forced password resets.
- Map password‑storage and credential‑monitoring controls to your audit framework (e.g., NIST CSF 2.0) and collect remediation evidence for continuous assurance.
Technical Notes
- Attack Vector: Unknown (data likely exfiltrated from a compromised web application).
- Data Types Exposed: Email addresses, names, passwords (MD5 hashes), phone numbers, physical addresses, purchase history, usernames.
- Source: HaveIBeenPwned – MEO breach