Qraved Data Breach Exposes Nearly 1 Million User Records Including MD5‑Hashed Passwords
What Happened — In July 2021 the Indonesian restaurant‑search platform Qraved suffered a breach that exposed 984,519 user accounts. The leaked data set contains email addresses, names, phone numbers, dates of birth and passwords stored as unsalted MD5 hashes.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of weak credential storage and inadequate access controls – a scenario continuous control‑assurance programs are built to detect, remediate, and evidence.
- Highlights the need for defensible audit trails around password handling, hashing standards, and privileged access monitoring.
- Aligns with the control objective of secure credential management, which maps to multiple frameworks (e.g., NIST CSF 2.0, ISO 27001).
Who Is Affected – Online consumer services, restaurant‑booking platforms, and any SaaS provider handling personal data.
Recommended Actions
- Review and upgrade password hashing algorithms to salted, computationally‑hard functions (e.g., bcrypt, Argon2).
- Implement strict access‑control policies for databases containing credential data and enforce least‑privilege.
- Capture continuous evidence of credential‑storage controls for audit readiness.
Technical Notes – The breach appears to be a result of compromised database access; passwords were stored as plain MD5 hashes, which are trivially reversible. No specific CVE is associated. Source: [Have I Been Pwned – Qraved breach]