90,000+ User Accounts Exposed in SirHurt Roblox Cheats Site Breach
What Happened — In April 2021 the Roblox‑focused cheat website SirHurt suffered a data breach that released 90,655 user records. The leak included email addresses, IP addresses, usernames and passwords that were stored only as unsalted MD5 hashes.
Why It Matters for Trust & Control Assurance
- The incident illustrates a classic credential‑protection failure that a continuous control‑assurance program should detect and remediate before exposure.
- Weak password hashing undermines the “protect credentials” control objective, which maps to many frameworks (e.g., NIST CSF 2.0 Identity Management).
- Demonstrating robust identity‑access controls and evidence of strong hashing practices is essential for audit readiness and defensible evidence.
Who Is Affected – Gaming‑related SaaS platforms, online communities, and any organization that stores user credentials without modern hashing.
Recommended Actions
- Immediately force password resets for all affected accounts and any accounts that reuse those credentials.
- Replace MD5 hashing with a salted, computationally‑hard algorithm (e.g., bcrypt, Argon2).
- Deploy multi‑factor authentication (MFA) for all privileged and user logins.
- Capture and retain evidence of the remediation steps for audit trails.
Technical Notes – The breach appears to have resulted from a server‑side compromise; no specific CVE is cited. Passwords were stored as plain MD5 hashes, a known weak algorithm vulnerable to rainbow‑table attacks. Source: https://haveibeenpwned.com/api/v3/breach/SirHurt