Reincubate Data Breach Exposes 616,146 Email Addresses, Names, and Password Hashes
What Happened – In October 2020, Reincubate disclosed that a backup taken in November 2017 was inadvertently exposed. The backup contained more than 616 k unique email addresses, associated names, and password hashes derived with PBKDF2.
Why It Matters for Trust & Control Assurance
- The incident illustrates a gap in credential‑storage controls that a continuous‑control‑assurance program would flag (e.g., encryption‑at‑rest, strong hashing, and regular backup protection).
- Demonstrates the need for auditable evidence that password policies, hashing algorithms, and backup handling are consistently enforced and monitored.
- Highlights the importance of having a defensible incident‑response trail that can be presented to auditors or regulators.
Who Is Affected – SaaS and app‑data providers, any organization that stores user credentials, and the 616 k end‑users whose accounts were compromised.
Recommended Actions
- Verify that all stored passwords use a modern, computationally‑hard KDF (e.g., PBKDF2 with sufficient iterations, Argon2, or scrypt).
- Rotate passwords for affected accounts and enforce multi‑factor authentication where possible.
- Review backup and storage procedures to ensure backups are encrypted, access‑controlled, and not publicly reachable.
- Capture evidence of these controls (policy documents, configuration screenshots, monitoring logs) for audit readiness.
Technical Notes – The exposed data originated from a 2017 backup; passwords were stored as PBKDF2 hashes, which, while salted, may still be vulnerable if iteration counts are low. No public CVE is associated, but the breach underscores misconfiguration of backup storage.