Muslim Directory Breach Exposes 37,784 User Accounts and Plain‑Text Passwords
What Happened — In February 2014 the UK‑based Muslim Directory (muslimdirectory.co.uk) was compromised by the hacker @th3inf1d3l. A public dump revealed 37,784 user records containing names, home addresses, age groups, email addresses, phone numbers, website activity and passwords stored in plain text.
Why It Matters for Trust & Control Assurance
- Unhashed passwords violate the core control objective of protecting credential confidentiality, a gap that continuous monitoring must surface and remediate.
- The incident demonstrates the need for auditable evidence that access‑control policies (e.g., MFA, least‑privilege) are enforced and that password storage meets cryptographic standards.
- Documenting the breach response provides a defensible audit trail for frameworks that require proof of credential protection.
Who Is Affected — Users of the Muslim Directory (UK community and businesses listed in the guide).
Recommended Actions
- Verify that all passwords are hashed with a strong algorithm (bcrypt, Argon2) and enforce MFA for all accounts.
- Rotate compromised credentials and notify affected individuals.
- Update incident‑response procedures and collect evidence of credential‑storage controls for audit readiness.
- Conduct a control‑mapping review against your framework of record. Source: [Have I Been Pwned – Muslim Directory breach]
Technical Notes — The breach appears to stem from inadequate password storage (plain‑text) and possibly credential theft; no specific CVE is associated. Exposed data types include personal identifiers, contact information, and website activity. Source: [HIBP API]