StreetEasy Data Breach Exposes Nearly 1 Million User Accounts
What Happened
In June 2016 the real‑estate listing platform StreetEasy experienced a breach that exposed 988,230 unique user records. The compromised data—email addresses, full names, usernames and SHA‑1 password hashes—were later listed for sale on a dark‑web marketplace in February 2019.
Why It Matters for Compliance & Audit Readiness
- Highlights the risk of weak credential‑storage practices, a control covered by NIST CSF PR.AC‑1 (Identity Management) and ISO 27001 A.9.2.
- Underscores the importance of continuous monitoring of third‑party data stores to produce defensible evidence for auditors.
- Provides a concrete example for documenting breach‑response procedures and evidence‑preservation requirements in audit programs.
Who Is Affected
- Real‑estate listing websites and online property portals
- SaaS platforms that store or process user credentials
- Organizations that integrate StreetEasy data feeds or APIs
Recommended Actions
- Review any contractual or data‑sharing relationships with StreetEasy.
- Validate that password storage uses modern, salted hashing algorithms (e.g., bcrypt, Argon2) and rotate any shared credentials.
- Ensure continuous monitoring controls capture anomalous credential‑theft activity.
- Request a detailed incident‑response disclosure from StreetEasy to update your risk register and audit evidence.
Technical Notes
- Attack vector: Likely unauthorized database access; exact method not disclosed.
- CVE(s): None reported.
- Data types exposed: Email addresses, full names, usernames, SHA‑1 password hashes.
Source: https://haveibeenpwned.com/api/v3/breach/StreetEasy