Planet Ice Booking Service Exposes 240,488 Customer Records in 2023 Data Breach
What Happened – In January 2023 the UK‑based ice‑skating rink reservation platform Planet Ice disclosed that an unauthorized party accessed its database. The breach released personal details for 240,488 individuals, including names, email addresses, physical addresses, phone numbers, dates of birth, genders, IP addresses and passwords stored as unsalted MD5 hashes.
Why It Matters for Trust & Control Assurance
- The incident highlights a gap in credential‑management and data‑protection controls that a continuous control‑assurance program is built to detect, remediate, and evidence.
- Secure password storage, encryption, and access‑control logging are control objectives that map to dozens of framework requirements (e.g., NIST CSF PR.AC‑1, ISO 27001 A.9).
- Demonstrating mature access‑control processes and audit‑ready evidence can reduce breach impact and support regulator‑driven investigations.
Who Is Affected – Consumer‑facing retail/online booking services, leisure‑industry operators, and any organization that stores personally identifiable information (PII) and authentication data.
Recommended Actions
- Conduct an immediate review of password‑storage mechanisms; replace MD5 hashes with salted, adaptive‑hashing algorithms (e.g., bcrypt, Argon2).
- Enforce multi‑factor authentication for all privileged accounts and privileged‑access pathways.
- Update data‑classification policies and ensure encryption‑at‑rest for PII.
- Capture and retain evidence of credential‑management controls for audit readiness (e.g., control‑owner attestations, configuration snapshots).
- Run a post‑incident audit to verify logging, detection, and incident‑response playbooks are fully operational.
Source: Have I Been Pwned – Planet Ice breach
Technical Notes
- Attack vector: exploitation of weak password‑hashing implementation (MD5) likely combined with credential‑theft or insider access.
- No public CVE; the flaw resides in insecure cryptographic practice rather than a software vulnerability.
- Exposed data types: DOB, email, gender, IP, name, password hash, phone, address, purchase history.
Source: HIBP breach details