PetFlow Data Breach Exposes Nearly 1 M Email Addresses and Password Hashes
What Happened
In December 2017, pet‑care delivery service PetFlow suffered a breach that released 990,919 user accounts. The compromised data set contained email addresses and passwords stored as unsalted MD5 hashes, which later appeared for sale on a dark‑web marketplace.
Why It Matters for Compliance & Audit Readiness
- Illustrates the control‑gap when passwords are hashed without salting; a continuous control‑assurance program must enforce strong, salted hashing algorithms and retain evidence of compliance.
- Highlights the importance of real‑time monitoring for credential‑theft indicators; documented detection and response activities satisfy audit requirements under NIST CSF Identify‑Detect‑Respond and ISO 27001 A.12.4.
- Provides a concrete incident that can be used to validate the effectiveness of vendor‑risk assessments and the existence of defensible evidence for credential‑management controls.
Who Is Affected
- E‑commerce and subscription platforms that handle pet‑care products.
- Any organization that stores customer credentials without robust hashing.
- Approximately one million PetFlow customers.
Recommended Actions
- Inventory all third‑party services that store passwords; verify they use salted, computationally‑hard hashing (e.g., bcrypt, Argon2).
- Deploy multi‑factor authentication (MFA) for both privileged and consumer accounts.
- Strengthen logging and continuous monitoring for anomalous credential‑access patterns; retain logs for audit trails.
- Request a detailed incident‑response disclosure from PetFlow and update your vendor‑risk register accordingly.
Technical Notes
- Attack vector: Unauthorized extraction of a user database; passwords were stored as unsalted MD5 hashes, enabling offline cracking.
- CVEs: None directly linked to this breach.
- Data types exposed: Email addresses, password hashes (MD5, unsalted).
Source: https://haveibeenpwned.com/api/v3/breach/PetFlow