Sundry Files File‑Upload Service Breach Exposes 274,461 Accounts
What Happened
In January 2022 the now‑defunct file‑upload platform Sundry Files suffered a data breach that released 274,461 unique records. Exposed data included email addresses, usernames, IP addresses and passwords stored as salted SHA‑256 hashes.
Why It Matters for Compliance & Audit Readiness
- Demonstrates the risk of relying on third‑party SaaS that lack demonstrable encryption‑at‑rest and key‑rotation controls.
- Highlights the need for continuous credential‑monitoring and proof of secure hash storage as part of a control‑assurance program.
- Serves as a real‑world example of why documented vendor‑risk assessments and incident‑response disclosures are essential for audit defensibility.
Who Is Affected
- Organizations that integrated third‑party file‑upload services into internal workflows.
- Enterprises across finance, healthcare, education and professional services that store employee or client email addresses in such platforms.
- Any user base where passwords are retained as salted hashes without additional protective layers (e.g., MFA, password‑less authentication).
Recommended Actions
- Review all current vendor relationships for file‑storage or upload capabilities; confirm encryption‑at‑rest and hash‑storage practices.
- Validate that continuous monitoring controls (e.g., credential‑leak detection, anomalous IP alerts) are active and tuned.
- Request a formal incident‑response disclosure from any provider that experienced a breach to enrich your audit evidence trail.
Technical Notes
- Attack vector: Likely unauthorized server access or credential compromise leading to bulk extraction of stored user records.
- CVE(s): None reported in the public disclosure.
- Data types exposed: Email addresses, usernames, IP addresses, password hashes (salted SHA‑256).
Source: https://haveibeenpwned.com/api/v3/breach/SundryFiles