Thingiverse Database Backup Leak Exposes 228,102 User Accounts
What Happened — In October 2021 a 36 GB backup taken from the 3D‑model sharing service Thingiverse (owned by MakerBot) began circulating in the hacking community. The file contained 228 102 unique user records, including email addresses, usernames, full names, dates of birth, IP addresses, physical addresses and password hashes stored as either unsalted SHA‑1 or bcrypt.
Why It Matters for Trust & Control Assurance
- The breach demonstrates a classic control‑gap: backups were not encrypted or access‑restricted, a scenario continuous‑control‑assurance programs are built to detect and evidence.
- Storing password hashes with weak, unsalted algorithms fails to meet basic credential‑protection objectives, undermining audit‑ready evidence of strong authentication controls.
- Mapping these failures to a single control objective (e.g., “protect backup data and enforce strong credential hashing”) satisfies requirements across multiple frameworks (NIST CSF, ISO 27001, SOC 2, etc.).
Who Is Affected
- SaaS platforms that host user‑generated content and personal data (Tech SaaS).
- Communities and businesses that rely on Thingiverse for 3‑D model distribution (design, education, prototyping).
Recommended Actions
- Secure backups – encrypt all backup media, enforce strict least‑privilege access, and maintain immutable logs of backup creation and retrieval.
- Upgrade credential storage – replace unsalted SHA‑1 hashes with a modern, salted algorithm (bcrypt, Argon2), and force password resets for all affected accounts.
- Control mapping – document backup‑protection and credential‑hashing controls against the Verisq Common Framework to generate defensible audit evidence.
Technical Notes
- Attack vector: Misconfiguration – unencrypted backup exposed.
- Data types exposed: Email, username, full name, date of birth, IP address, physical address, password hashes (unsalted SHA‑1, bcrypt).
- Source: HIBP breach feed (provided by dehashed.com).