ReverbNation Breach Exposes Over 7 Million User Emails and SHA1 Password Hashes
What Happened — In January 2014 the online music‑career platform ReverbNation suffered a data breach that remained undetected until September 2015. The breach released 7,040,725 unique email addresses together with salted SHA‑1 password hashes.
Why It Matters for Trust & Control Assurance
- Continuous credential‑security monitoring is essential to detect weak hashing algorithms before they become a compliance liability.
- Documented evidence of strong password policies, MFA adoption, and regular hash upgrades provides a defensible audit trail.
- Ongoing assurance of access‑control controls helps demonstrate due‑diligence to regulators and partners.
Who Is Affected — Media & entertainment services that host user accounts, particularly platforms serving musicians and independent artists.
Recommended Actions
- Replace SHA‑1 hashing with a modern algorithm (e.g., bcrypt, Argon2) and enforce password rotation.
- Deploy multi‑factor authentication for all user logins.
- Implement continuous monitoring of credential‑related controls and retain evidence for audit readiness.
Source: Have I Been Pwned – ReverbNation breach
Technical Notes — Exposed data: email addresses, salted SHA‑1 password hashes. Attack vector not publicly disclosed; breach persisted for over a year before detection. Source: Have I Been Pwned – ReverbNation breach