Retina‑X Breach Exposes 71,153 Email Addresses and Unsalted Password Hashes
What Happened — In February 2017 the mobile‑device monitoring platform Retina‑X was hacked. Attackers downloaded the account database—71,153 email addresses paired with MD5 password hashes that were stored without any salting—before the data was wiped from the company’s servers. The breach was publicly disclosed by Retina‑X in an April 27 2017 blog post and later listed in Have I Been Pwned.
Why It Matters for Trust & Control Assurance
- Highlights the need for continuous monitoring of credential‑storage controls and evidence that hashing algorithms meet modern security standards.
- Demonstrates why a defensible audit trail of password‑policy enforcement is essential for demonstrating control‑assurance to regulators and partners.
- Connects directly to Verisq’s Access Controls capability, which helps organizations capture, validate, and continuously evidence strong identity‑and‑access‑management practices.
Who Is Affected
- SaaS providers in the mobile‑device monitoring and endpoint‑security space.
- Any organization that integrates Retina‑X into its employee‑monitoring or BYOD programs.
Recommended Actions
- Replace MD5 hashes with a salted, computationally‑hard algorithm (e.g., bcrypt, Argon2).
- Review and tighten server‑access permissions; enforce multi‑factor authentication for privileged accounts.
- Document the incident in your control‑assurance logs and map the findings to relevant control objectives for audit readiness.
Source: Have I Been Pwned – Retina‑X breach
Technical Notes
- Exposed data: email addresses and unsalted MD5 password hashes.
- No CVE associated; breach resulted from a direct compromise of Retina‑X’s backend infrastructure.
Source: Motherboard article “Inside the ‘Stalkerware’ Surveillance Market…”