Raychat Data Breach Exposes Nearly 939K User Accounts, Including Password Hashes
What Happened — In January 2021 the Iranian social‑media service Raychat suffered a breach that released 938,981 unique records. The dump contained email addresses, names, IP addresses, browser user‑agent strings and passwords stored as bcrypt hashes. The data was later added to Have I Been Pwned by dehashed.com.
Why It Matters for Trust & Control Assurance
- Highlights the risk of inadequate credential‑storage controls – a core control objective for any continuous assurance program.
- Demonstrates why ongoing monitoring of password‑hashing practices and evidence of strong cryptographic standards are essential for audit readiness.
- Provides a real‑world example of how missing safeguards can erode defensible evidence of due‑diligence during a compliance review.
Who Is Affected – Social‑media platforms, SaaS providers handling user credentials, and any organization that stores password hashes without proven hardening.
Recommended Actions
- Verify that password hashing uses current, industry‑recommended algorithms (e.g., bcrypt with appropriate cost).
- Implement continuous credential‑storage monitoring and periodic evidence collection for audit trails.
- Rotate compromised passwords, enforce multi‑factor authentication, and notify affected users per applicable regulations.
- Conduct a post‑incident review to map findings to your control‑objective framework and remediate gaps.
Source: Have I Been Pwned – Raychat breach
Technical Notes
- No public CVE; breach appears to stem from a server‑side data leak or misconfiguration.
- Exposed data types: email, name, IP address, browser user‑agent, bcrypt password hashes.
Source: HIBP breach details