Read Novel Data Breach Exposes 22.4 M User Accounts
What Happened — In May 2019 the Chinese literature portal readnovel.com suffered a breach that released 22,424,472 records. The dump contained email addresses, usernames, genders, phone numbers and passwords stored as salted MD5 hashes.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of weak credential‑storage practices; continuous monitoring of password‑hashing standards is a core control‑assurance activity.
- Highlights the need for documented incident‑response evidence to prove timely detection, containment and notification.
- Provides a real‑world data‑exposure scenario that maps to the “identity and access control” control objective, which underpins many frameworks (e.g., NIST CSF 2.0).
Who Is Affected – Online media platforms, SaaS publishers, and any service that stores user credentials in legacy hash formats.
Recommended Actions
- Review and upgrade password‑storage algorithms to industry‑recommended salted bcrypt/Argon2.
- Implement continuous credential‑policy monitoring and generate audit‑ready evidence of compliance.
- Refresh incident‑response playbooks, ensuring logs capture authentication anomalies and that breach‑notification procedures are documented.
Source: Have I Been Pwned – Read Novel breach
Technical Notes – The breach disclosed salted MD5 password hashes, a legacy algorithm vulnerable to offline cracking. No specific CVE is associated; the attack vector remains unknown but likely involved inadequate access controls or a misconfiguration of the user database.
Source: same as above