116,465 User Accounts Compromised in Pokémon Creed Data Breach – Plain‑Text Passwords Exposed
What Happened — In August 2014 the Pokémon Creed RPG website was hacked and the attacker posted a full MySQL dump containing 116,465 usernames, email addresses, genders, IP addresses, website‑activity logs and plain‑text passwords.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of inadequate credential protection – a core control area that continuous‑control‑assurance programs must monitor and evidence.
- Highlights the need for defensible audit trails around password‑storage policies (hashing, salting, rotation) to satisfy multiple frameworks simultaneously.
- Shows why ongoing third‑party risk monitoring and evidence collection are essential to prove due‑diligence after a breach.
Who Is Affected – Online gaming platforms, web‑based SaaS services, and any organization that stores user credentials without strong cryptographic safeguards.
Recommended Actions
- Immediately force password resets for all compromised accounts and enforce strong password policies.
- Replace plain‑text storage with industry‑standard salted hashing (e.g., Argon2, bcrypt).
- Implement multi‑factor authentication and log all credential‑change events for audit readiness.
- Conduct a control‑mapping review of your credential‑management processes and collect evidence for continuous monitoring.
Technical Notes – The breach was disclosed via a public dump on a rival site; the exact intrusion method was not detailed (attack vector unknown). Exposed data types: email addresses, usernames, genders, IP addresses, website activity, and clear‑text passwords. Source: Have I Been Pwned – Pokémon Creed breach