ShockGore Breach Exposes 73,944 User Accounts, Password Hashes and Private Messages
What Happened — In August 2020 the ShockGore website, a platform for graphic video and image sharing, suffered a data breach that released 73,944 unique records. Exposed data include email addresses, usernames, IP addresses, gender fields, unsalted SHA‑1 password hashes, and private messages containing disturbing content.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of weak credential storage — unsalted SHA‑1 hashes are easily cracked, violating best‑practice identity‑access controls.
- Highlights the need for continuous evidence that password policies, hashing standards, and monitoring are enforced across the data lifecycle.
- Shows how a single mis‑configuration can erode user trust and create audit‑ready gaps in credential‑management controls.
Who Is Affected – Media & content‑hosting platforms, user‑generated‑content sites, any online community that stores user credentials.
Recommended Actions –
- Replace unsalted SHA‑1 hashes with a modern, salted algorithm (e.g., Argon2id).
- Enforce multi‑factor authentication for all privileged accounts.
- Conduct a credential‑storage audit and map findings to your control‑assurance program.
- Update incident‑response playbooks to include credential‑theft scenarios.
Source: Have I Been Pwned – ShockGore breach
Technical Notes – The breach appears to stem from a server‑side misconfiguration that left the user database publicly accessible. No specific CVE is cited. Exposed data types: email, username, IP, gender, SHA‑1 password hash, private messages.
Source: HIBP breach details