Nexus Mods Breach Exposes Nearly 6 Million User Accounts
What Happened — In December 2015 Nexus Mods disclosed that a 2013 hack had compromised the site’s user database. The breach exposed 5,915,013 records containing usernames, email addresses and password hashes (stored with salts).
Why It Matters for Trust & Control Assurance
- The incident illustrates the risk of inadequate credential protection and the need for continuous verification that password storage meets strong cryptographic standards.
- A robust access‑control assurance program provides defensible evidence that authentication mechanisms are regularly reviewed, tested, and aligned with industry‑accepted controls.
- Continuous monitoring of credential‑related alerts helps detect unauthorized access early, supporting an auditable trail for compliance reviews.
Who Is Affected – Gaming and mod‑ding communities, SaaS platforms that host user‑generated content, and any service that re‑uses credentials from compromised sites.
Recommended Actions – Review your password hashing algorithms against current best practices, implement regular credential‑access audits, and ensure logging of authentication events is retained for forensic analysis. Source: https://haveibeenpwned.com/api/v3/breach/NexusMods
Technical Notes – The breach involved a successful intrusion of the Nexus Mods web application; the exact attack vector was not disclosed. Exfiltrated data included email addresses, usernames and salted password hashes. Source: https://haveibeenpwned.com/api/v3/breach/NexusMods