10.2M User Accounts Exposed in Raaga Streaming Service Breach
What Happened – In December 2025, data from the Indian music‑streaming platform Raaga was posted for sale on a hacking forum. The leak contains 10,225,145 unique records, including email addresses, names, genders, ages (or full dates of birth), postcodes and passwords stored as unsalted MD5 hashes.
Why It Matters for Trust & Control Assurance
- Weak password hashing is a classic control gap that continuous‑control‑assurance programs are designed to detect, remediate and evidence.
- Demonstrable credential‑protection controls (strong hashing, MFA, monitoring of credential exposure) provide defensible audit evidence across frameworks such as NIST CSF 2.0.
- Ongoing verification that credential‑related controls remain effective is a core component of the Access Controls capability.
Who Is Affected – Media & entertainment streaming services, online consumer platforms handling personal data, and any organization that stores user credentials without strong cryptographic protection.
Recommended Actions
- Audit current password‑storage mechanisms; replace unsalted MD5 with salted, computationally‑hard hashes (e.g., bcrypt, Argon2).
- Enforce multi‑factor authentication for all user accounts.
- Deploy continuous credential‑exposure monitoring and integrate findings into your control‑assurance reporting.
Source: Have I Been Pwned – Raaga breach
Technical Notes – The breach involved passwords stored as unsalted MD5 hashes, a known weak algorithm vulnerable to rainbow‑table attacks. The data set was posted on a public hacking forum, indicating a credential‑theft vector rather than a ransomware or denial‑of‑service event.
Source: Have I Been Pwned – Raaga breach