41.8M User Accounts Exposed in piZap Photo‑Editing Service Breach
What Happened — In December 2017 the online photo‑editing site piZap was breached. A dark‑web dump released in February 2019 contained ≈ 42 million unique email addresses, names, genders, geographic locations, social‑media profile links, usernames, and, for accounts created directly on piZap, passwords stored as SHA‑1 hashes.
Why It Matters for Trust & Control Assurance
- Weak password hashing (SHA‑1) signals a gap in credential‑storage controls that a continuous‑control‑assurance program must detect and remediate.
- The exposure of personal identifiers demonstrates the need for documented data‑protection policies and evidence of their enforcement to satisfy audit requirements.
- Demonstrable remediation (e.g., stronger KDFs, MFA) provides defensible proof of due‑diligence for regulators and partners.
Who Is Affected — Consumer‑focused SaaS platforms, web applications that allow direct registration or social‑login authentication, and any service handling large volumes of personal data.
Recommended Actions
- Replace SHA‑1 hashes with a modern password‑hashing algorithm (bcrypt, Argon2) and force password resets for all affected users.
- Deploy multi‑factor authentication for both native and social‑login accounts.
- Conduct a credential‑storage control review, capture evidence of the new hashing process, and map findings to your audit framework.
Technical Notes — Attack vector unknown; breach likely stemmed from inadequate protection of authentication data. Exposed data types: email, name, gender, location, social‑media profile links, usernames, and SHA‑1 password hashes. Source: [Have I Been Pwned – piZap breach]