Quidd Marketplace Breach Exposes 3.8M User Credentials
What Happened — In 2019 the online collectibles marketplace Quidd suffered a data breach that exposed 3,805,863 user accounts. The compromised data included email addresses, usernames and passwords stored as bcrypt hashes. The stolen credentials were later sold and widely redistributed on hacking forums.
Why It Matters for Trust & Control Assurance
- The incident illustrates a classic failure of credential‑management controls that a continuous assurance program is built to detect, document and remediate.
- Evidence of strong password hashing, MFA enforcement and real‑time monitoring of credential stores is essential for a defensible audit trail.
- Incident‑response documentation and post‑breach forensics provide the proof points auditors look for when evaluating access‑control maturity.
Who Is Affected
- Retail‑e‑commerce platforms and any online service that stores user credentials.
Recommended Actions
- Verify that passwords are hashed with a modern, salted algorithm (e.g., bcrypt, Argon2) and rotate any weak hashes.
- Deploy multi‑factor authentication for all user accounts, especially privileged access.
- Strengthen logging and continuous monitoring of authentication services to detect anomalous credential access.
- Update incident‑response playbooks to include credential‑theft scenarios and ensure evidence collection aligns with audit requirements.
Technical Notes
- Attack vector: unknown; breach likely involved unauthorized access to the credential database.
- Data types exposed: email addresses, usernames, bcrypt‑hashed passwords.
- No public CVE; the breach is a data‑exfiltration event rather than a software flaw.
Source: Have I Been Pwned – Quidd breach