StoryBird Breach Exposes Over 1 Million User Credentials
What Happened
In August 2015 the storytelling platform StoryBird suffered a data breach that released 1,047,200 user records. The exposed data set includes email addresses, full names, usernames, and passwords stored as PBKDF2 hashes. The breach details were supplied to Have I Been Pwned (HIBP) by dehashed.com.
Why It Matters for Compliance & Audit Readiness
- Demonstrates the need for continuous control‑assurance around third‑party credential storage and hashing practices.
- Highlights the importance of documenting vendor‑risk assessments and maintaining defensible evidence of encryption/hashing standards.
- Reinforces that a robust monitoring program must capture anomalous data exfiltration events, even for legacy incidents.
Who Is Affected
- Educational technology and digital storytelling services.
- SaaS platforms that integrate StoryBird for content creation.
- Any organization whose employees or students used StoryBird accounts.
Recommended Actions
- Review all contracts and risk registers for exposure to StoryBird services.
- Validate that stored passwords use current, strong hashing (e.g., PBKDF2 with sufficient iterations) and consider forced password resets for any shared credentials.
- Ensure continuous monitoring controls can detect large‑scale credential leaks from third‑party providers.
- Request a detailed incident‑response report from StoryBird to confirm remediation steps and timeline.
Technical Notes
- Attack vector: Not publicly disclosed; breach likely involved unauthorized access to backend data stores.
- CVEs: None reported.
- Data types exposed: Email addresses, full names, usernames, PBKDF2‑hashed passwords.
Source: https://haveibeenpwned.com/api/v3/breach/StoryBird