SongTrivia2 Data Breach Exposes 291,739 User Accounts, Including Password Hashes and OAuth Tokens
What Happened — In April 2026 the music‑trivia service SongTrivia2 suffered a breach that was posted to a public hacking forum. The leak contains 291,739 unique email addresses, usernames, real names, avatar images, and authentication data (Google OAuth tokens and bcrypt password hashes).
Why It Matters for Trust & Control Assurance
- The incident illustrates the exact risk that continuous credential‑management controls are meant to detect and mitigate – unauthorized access to stored authentication secrets.
- Demonstrates the need for auditable evidence that password storage follows strong hashing standards, token rotation policies are enforced, and access to credential stores is continuously monitored.
- Highlights how a robust access‑control program provides a defensible audit trail for regulators and partners demanding proof of secure authentication practices.
Who Is Affected – Consumer‑facing web and mobile applications that handle OAuth logins and store user passwords (media/entertainment SaaS, gaming, social platforms).
Recommended Actions
- Verify that all password hashes use a current, memory‑hard algorithm (e.g., bcrypt with appropriate work factor) and rotate any exposed OAuth tokens.
- Implement continuous monitoring of credential‑store access logs and enforce MFA for privileged accounts that can query the database.
- Update your incident‑response playbook to include rapid token revocation and user notification procedures for credential exposure.
Source: Have I Been Pwned – SongTrivia2 breach
Technical Notes
- Data was extracted from the platform’s user database; the exact exploitation vector was not disclosed.
- Exposed data types: email addresses, names, usernames, avatar URLs, OAuth access tokens, bcrypt password hashes.
Source: HIBP breach details