Minted Marketplace Breach Exposes 4.4 M Customer Records Including Password Hashes
What Happened — In May 2020 the online marketplace Minted suffered a data breach that released 4,418,182 unique customer records. The exposed data set includes email addresses, names, physical addresses, phone numbers and passwords stored as bcrypt hashes. The stolen data was later posted on a dark‑web marketplace and reported to Have I Been Pwned.
Why It Matters for Trust & Control Assurance
- The incident illustrates a gap in credential protection—a core control that continuous‑monitoring programs must verify and evidence.
- Demonstrates the need for auditable proof that passwords are hashed with strong, salted algorithms and that access to credential stores is tightly governed.
- Highlights why organizations should maintain a defensible audit trail of password‑policy enforcement, MFA adoption, and breach‑response actions.
Who Is Affected — E‑commerce platforms, online marketplaces, SaaS services that store personally identifiable information and credential data.
Recommended Actions
- Force an immediate password reset for all users and require multi‑factor authentication.
- Validate that password storage uses industry‑standard salted hashing (e.g., bcrypt) and document the process for auditors.
- Deploy continuous monitoring of credential‑store access and anomalous activity, capturing evidence for control‑assurance reporting.
Source: Have I Been Pwned – Minted breach
Technical Notes
- Attack vector not disclosed; breach likely involved unauthorized access to the credential database.
- Passwords were stored as bcrypt hashes, which mitigates but does not eliminate risk if the hash database is exfiltrated.
- Data types exposed: email, name, physical address, phone number, password hash.
Source: HIBP breach details