ShareThis Breach Exposes 40.9M Accounts, Including Password Hashes
What Happened — In July 2018 the social‑sharing platform ShareThis suffered a data breach that released 40,960,499 unique records. The exposed data set contains email addresses, names, dates of birth (when available) and password hashes. The compromised data resurfaced on a dark‑web marketplace in 2019 and was later added to Have I Been Pwned.
Why It Matters for Trust & Control Assurance —
- The incident illustrates a classic failure to protect credential data, a control area that continuous assurance programs must monitor and evidence.
- Demonstrating robust identity‑and‑access controls (password hashing standards, MFA, credential rotation) provides defensible audit evidence across frameworks such as NIST CSF 2.0.
- Ongoing third‑party monitoring and evidence collection can surface similar gaps before they become public exposures.
Who Is Affected — SaaS providers, digital‑marketing platforms, and any organization that integrates third‑party sharing widgets; broadly, the 40 M+ end‑users whose personal data was compromised.
Recommended Actions —
- Verify that all stored passwords use strong, salted hashing algorithms (e.g., Argon2, bcrypt).
- Implement MFA for privileged and user accounts, and enforce credential rotation policies.
- Conduct a control‑mapping exercise to align your credential‑protection controls with the VCF “Identity & Access Management” objective and collect evidence for audit readiness.
Technical Notes —
- Attack vector not publicly disclosed; breach likely involved credential theft or insecure storage.
- Data types exposed: email, name, date of birth, password hashes.
- No known CVE; the issue is a data‑exfiltration incident rather than a software vulnerability.