Moneycontrol Breach Exposes 762,874 Accounts with Plain‑Text Passwords
What Happened — In April 2021, threat actors posted for sale a data set originating from the Indian financial news platform Moneycontrol. The file contains 762,874 unique records with email addresses, phone numbers, gender, geographic location, dates of birth and plain‑text passwords. The data appears to have been compiled in September 2017, and Moneycontrol has described it as “an old data set.”
Why It Matters for Trust & Control Assurance
- The exposure of unhashed passwords demonstrates a failure in basic credential‑storage controls, a core objective of any continuous control‑assurance program.
- Detecting and documenting credential‑leak events provides defensible evidence for audit readiness and demonstrates due‑diligence to regulators and partners.
- Implementing strong identity‑and‑access‑control measures (password hashing, MFA, credential‑leak monitoring) directly addresses the control gap highlighted by this breach.
Who Is Affected – Financial‑services websites, online media platforms, and any organization that stores consumer credentials in a similar fashion, particularly in the Indian market.
Recommended Actions
- Verify that all stored passwords are hashed with a strong, salted algorithm (e.g., Argon2, bcrypt).
- Enforce mandatory multi‑factor authentication for all user accounts.
- Deploy continuous credential‑leak monitoring to receive alerts when passwords appear in public breach feeds and retain the alerts as audit evidence.
- Map these actions to the “credential protection” control area in your chosen framework and collect evidence for audit readiness.
Technical Notes – Exposed data types: email, gender, geographic location, phone number, date of birth, plain‑text password. Attack vector unknown; breach likely stemmed from a 2017 compromise of the underlying database. Source: Have I Been Pwned – Moneycontrol breach