Nitro PDF Service Breach Exposes 77.2 M Email Addresses, Names, and Password Hashes
What Happened — In September 2020 the Nitro PDF SaaS platform suffered a data breach that released more than 77 million unique email addresses, associated names, bcrypt password hashes, and the titles of converted documents. The compromised data set was later shared with Have I Been Pwned via dehashed.com.
Why It Matters for Trust & Control Assurance
- Continuous credential‑exposure monitoring is a core control‑assurance activity; a breach of this scale demonstrates the risk of unmanaged password assets.
- Documented password‑policy enforcement (e.g., MFA, hash‑strength standards) provides defensible evidence for auditors and regulators.
- The incident highlights the need for an auditable incident‑response workflow that captures evidence of remediation and ongoing oversight.
Who Is Affected — SaaS PDF conversion providers and their enterprise customers across all verticals that rely on Nitro for document handling.
Recommended Actions
- Initiate an immediate forced password reset for all Nitro users and mandate multi‑factor authentication.
- Deploy continuous credential‑exposure monitoring (e.g., automated HIBP checks) to detect future leaks.
- Map password‑management practices to the control objective of credential lifecycle management and collect evidence for audit readiness. Source: Have I Been Pwned breach record
Technical Notes
- Exposed data: email addresses, full names, bcrypt password hashes, document titles.
- No specific vulnerability (CVE) disclosed; breach vector remains unknown. Source: HIBP breach details