Scentbird Breach Exposes 5.8 M Customer Records Including Password Hashes
What Happened — In June 2020 the online fragrance‑subscription service Scentbird suffered a data breach that released personal information for 5,814,988 customers. Exposed data included names, email addresses, genders, dates of birth, and password‑strength indicators together with bcrypt‑hashed passwords.
Why It Matters for Trust & Control Assurance
- The incident illustrates a gap in credential‑storage controls that a continuous‑control‑assurance program would flag and document.
- Demonstrates the need for verifiable evidence (e.g., hashing algorithm, salt management) to satisfy audit requirements around data protection.
- Highlights the importance of real‑time monitoring of database access and breach‑detection logs to maintain a defensible security posture.
Who Is Affected – Retail and e‑commerce subscription services that manage large volumes of consumer credentials; any organization storing personally identifiable information and password hashes.
Recommended Actions – Review and harden password‑storage policies (ensure strong, salted hashing), rotate compromised credentials, enable multi‑factor authentication for customer and privileged accounts, expand logging and continuous monitoring of database activity, and update incident‑response playbooks to capture credential‑leak evidence. Source: Have I Been Pwned – Scentbird breach
Technical Notes – Data types exposed: names, email addresses, genders, dates of birth, password‑strength indicators, bcrypt password hashes. The breach was reported to HIBP by breachbase.pw; no specific vulnerability (CVE) was disclosed. Source: HIBP breach detail