PlayStation PSP Forum (PSP ISO) Breach Exposes 1.27M User Accounts and Password Hashes
What Happened – In September 2015 the PSP ISO PlayStation forum, powered by vBulletin, was hacked. Attackers exfiltrated 1,274,070 records containing email addresses, IP addresses, usernames and salted MD5 password hashes.
Why It Matters for Trust & Control Assurance
- Highlights a gap in credential‑storage controls—weak hashing algorithms undermine the integrity of user authentication.
- Demonstrates the need for continuous monitoring of access‑control policies and evidence collection to prove compliance with audit requirements.
- Provides a concrete example of why a defensible incident‑response and logging program is essential for trustworthy operations.
Who Is Affected – Gaming and entertainment platforms that host public forums or community sites.
Recommended Actions – Review and upgrade password‑hashing mechanisms (e.g., migrate to bcrypt or Argon2), enforce multi‑factor authentication for forum access, and conduct a credential‑storage audit to generate audit‑ready evidence. Source: [Have I Been Pwned – PSP ISO breach]
Technical Notes – The breach involved a compromise of a vBulletin forum; no specific CVE was disclosed, but the use of salted MD5 hashes indicates inadequate cryptographic controls. Source: [Have I Been Pwned – PSP ISO breach]