PropTiger Exposes Over 2.1 M User Accounts in 2018 Data Breach
What Happened — In January 2018 the Indian property‑listing site PropTiger suffered a breach that leaked a 3.46 GB database. The dump, later posted on a hacking forum in 2020, contained more than 2 million unique email addresses together with names, dates of birth, gender, IP addresses, device details and passwords stored as unsalted MD5 hashes.
Why It Matters for Trust & Control Assurance
- The incident illustrates the risk of weak credential‑storage practices—a control area that continuous assurance programs must monitor and evidence.
- Demonstrable evidence of secure password hashing, credential‑access reviews, and timely breach‑notification processes are essential for a defensible audit trail.
Who Is Affected – Real‑estate portals, online marketplaces, and any SaaS platforms that manage large volumes of consumer credentials.
Recommended Actions –
- Replace legacy MD5 hashes with salted, adaptive algorithms (e.g., bcrypt, Argon2).
- Institute regular credential‑storage reviews and automated alerts for exposed hashes.
- Document hashing policies and evidence of enforcement for audit readiness.
Source: Have I Been Pwned – PropTiger breach
Technical Notes – The breach was a data‑exfiltration event; the exact attack vector was not disclosed. Exposed data types include personal identifiers and password hashes, which are vulnerable to offline cracking. Source: same as above