Credential‑Stuffing List “Pemiblanc” Leaks Over 110 Million Email Addresses and Passwords
What Happened
In April 2018 a list of 110,964,206 email‑address/password pairs, dubbed “Pemiblanc,” was discovered on a French server. The list aggregates credentials harvested from multiple prior data‑breaches and is being used for credential‑stuffing attacks against other online services.
Why It Matters for Compliance & Audit Readiness
- Demonstrates the risk of unmanaged credential exposure that a continuous control‑assurance program must detect, document, and remediate.
- Highlights the need for defensible evidence of password hygiene (e.g., MFA adoption, password rotation) to satisfy audit requirements such as NIST CSF PR‑AT and ISO 27001 A.9.2.
- Reinforces the importance of real‑time monitoring for compromised credentials as a control that can be reported in third‑party risk assessments.
Who Is Affected
- Any organization that stores user email addresses and passwords, especially SaaS platforms, e‑commerce sites, and consumer‑facing portals.
- Industries with large user bases (retail, media, education, health‑tech) that may have reused credentials from other breached services.
Recommended Actions
- Conduct an inventory of all accounts that may contain credentials matching the Pemiblanc list.
- Enforce multi‑factor authentication and password‑strength policies across all user accounts.
- Deploy credential‑monitoring services to receive alerts when exposed passwords appear in login attempts.
- Initiate forced password resets for users whose credentials are identified in the list.
- Document the response in your continuous control‑assurance platform to maintain audit‑ready evidence.
Technical Notes
- Attack vector: Credential stuffing using publicly available email/password pairs.
- CVE(s): None reported.
- Data types exposed: Email addresses, passwords (plaintext or weakly hashed).