Pluto TV Breach Exposes 3.2M User Accounts and Password Hashes
What Happened – In October 2018 the streaming service Pluto TV suffered a data breach that leaked the personal details of 3,225,080 accounts, including email addresses, IP addresses, names, dates of birth, genders, usernames and bcrypt‑hashed passwords. The breach was later disclosed on Have I Been Pwned; Pluto TV did not proactively inform affected users.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of inadequate credential‑storage controls; continuous monitoring of password‑hashing practices is a core control‑assurance activity.
- Highlights the need for a documented incident‑response and breach‑notification process that can produce defensible audit evidence.
- Aligns with the control objective of protecting authentication assets and ensuring that access‑control policies are enforceable and auditable.
Who Is Affected – Media‑streaming platforms, entertainment‑technology providers, any SaaS that stores end‑user credentials.
Recommended Actions
- Verify that passwords are stored using strong, salted hashing (e.g., bcrypt) and rotate hashing algorithms as needed.
- Implement continuous credential‑monitoring to detect unauthorized access to authentication stores.
- Formalize a breach‑notification workflow that meets regulatory expectations and can be demonstrated during audits.
Technical Notes – Exposed data types: email, IP, name, DOB, gender, username, device info, social‑media profiles, and bcrypt password hashes. The breach was first reported by dehashed.com to Have I Been Pwned. Source: https://haveibeenpwned.com/api/v3/breach/PlutoTV