Pokébip Breach Exposes 657,001 Accounts with Unsalted MD5 Password Hashes
What Happened — In July 2015 the French Pokémon community site Pokébip suffered a data breach that released the personal data of 657,001 registered users. The exposed records included email addresses, IP addresses, usernames, time‑zone information, website‑activity logs and passwords that were stored as unsalted MD5 hashes.
Why It Matters for Trust & Control Assurance
- Weak password hashing is a classic control gap that a continuous control‑assurance program is designed to detect, remediate, and document.
- Demonstrating robust credential‑storage practices (salted, computationally‑hard hashes, periodic rotation) provides defensible evidence for audit readiness across multiple frameworks.
- Ongoing monitoring of authentication controls helps prove due‑diligence and reduces the risk of credential‑theft‑driven breaches.
Who Is Affected – Online community platforms, SaaS web services, gaming portals, and any organization that stores user credentials without strong cryptographic safeguards.
Recommended Actions –
- Immediately force password resets for all affected accounts and any accounts using the same hashing method.
- Replace unsalted MD5 with a modern, salted algorithm such as bcrypt, Argon2, or PBKDF2.
- Implement continuous monitoring of credential‑storage controls and retain evidence of hashing policy compliance for audit purposes.
- Review and update your identity‑and‑access‑management (IAM) policies to enforce strong password‑hashing standards.
Technical Notes – The breach disclosed unsalted MD5 password hashes, a known weak algorithm vulnerable to pre‑computed rainbow‑table attacks. No specific CVE is associated; the issue stems from insecure credential‑storage practices. Source: https://haveibeenpwned.com/api/v3/breach/Pokebip