MySpace Breach Exposes 359,420,698 Accounts with Unsalted Password Hashes
What Happened — In a breach dating to roughly 2008, the MySpace platform suffered a data compromise that later surfaced on a dark‑web market in 2016. The leaked dataset contained 359,420,698 records: email addresses, usernames and SHA‑1 hashes of the first ten characters of passwords, stored without a salt.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of weak credential‑storage practices, a control area that continuous‑control assurance programs must monitor and evidence.
- Highlights the need for auditable password‑hashing policies (e.g., salted, computationally‑hard algorithms) to satisfy multiple frameworks such as NIST CSF and ISO 27001.
- Provides a concrete example of why organizations should maintain up‑to‑date evidence of credential‑protection controls for audit readiness.
Who Is Affected – Social‑media platforms, online service providers, and any organization that stores user passwords.
Recommended Actions – Review and upgrade password‑hashing mechanisms to salted, memory‑hard algorithms (e.g., bcrypt, Argon2); conduct a credential‑storage audit; update incident‑response playbooks to include credential‑exposure scenarios. Source: Have I Been Pwned – MySpace breach
Technical Notes – The breach likely stemmed from insecure legacy storage; hashes were SHA‑1 of the first 10 characters, unsalted, making offline cracking feasible. No specific CVE is associated. Source: same as above