MyHeritage Breach Exposes 92 Million Email Addresses and Password Hashes
What Happened — In October 2017 the genealogy platform MyHeritage suffered a data breach that exposed 91,991,358 user accounts. The leak included email addresses and salted SHA‑1 password hashes. The breach was disclosed seven months later after a security researcher alerted the company; the data resurfaced on dark‑web marketplaces in 2019.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of weak credential‑storage practices; continuous monitoring of password‑hashing algorithms is a core control‑assurance activity.
- Highlights the need for auditable evidence that credential protection policies (e.g., strong hashing, MFA) are enforced and regularly reviewed.
- Provides a real‑world example of why organizations must maintain a defensible trail of access‑control decisions to satisfy multiple compliance frameworks.
Who Is Affected – Consumer‑focused SaaS providers (genealogy, social platforms) and any organization that stores user‑generated credentials.
Recommended Actions
- Conduct an immediate audit of password‑storage mechanisms; replace SHA‑1 with a modern, memory‑hard hash (e.g., Argon2).
- Enforce multi‑factor authentication for all user accounts and privileged access.
- Implement continuous credential‑access monitoring and retain evidence of policy enforcement for audit readiness.
Technical Notes – The breach involved the extraction of salted SHA‑1 password hashes and email addresses; no specific CVE was disclosed. The attack vector remains unknown, but the impact stems from inadequate hashing standards and insufficient credential‑access controls. Source: Have I Been Pwned – MyHeritage breach