Morele.net Breach Exposes 2.47M Customer Records Including Password Hashes
What Happened – In October 2018 the Polish e‑commerce site Morele.net suffered a data breach that leaked 2,467,304 unique email addresses, names, phone numbers and passwords stored as MD5‑crypt hashes.
Why It Matters for Trust & Control Assurance
- The exposure of credential hashes signals a lapse in password‑storage and access‑control safeguards that a continuous control‑assurance program is built to detect and remediate.
- Demonstrating robust identity‑management controls (e.g., modern hashing, privileged‑access monitoring) provides defensible evidence for audit readiness under data‑protection regulations.
- Ongoing monitoring and evidence collection around credential protection helps prove due‑diligence to regulators and partners.
Who Is Affected – Retail and e‑commerce operators handling EU personal data, as well of any downstream services that integrated with Morele.net’s customer database.
Recommended Actions
- Upgrade password hashing to salted, memory‑hard algorithms such as bcrypt or Argon2.
- Deploy continuous monitoring of privileged access and retain immutable logs for forensic analysis.
- Map credential‑protection controls to your audit framework and collect evidence in a Trust Center.
Technical Notes – The breach disclosed email addresses, full names, phone numbers and password hashes (MD5‑crypt). The exact attack vector was not disclosed, but the use of weak hashing indicates inadequate credential‑storage controls. Source: [Have I Been Pwned – Morele.net breach]