TNAFlix Breach Exposes 1.37 M Accounts with Plain‑Text Passwords
What Happened — In June 2022 the adult‑content site TNAFlix suffered a data breach that released 1,374,344 user records. The leaked data included email addresses, IP addresses, usernames and passwords stored in clear text.
Why It Matters for Trust & Control Assurance
- Storing passwords in plain text violates fundamental credential‑protection controls that a continuous assurance program must monitor.
- The incident underscores the need for immutable evidence that password‑hashing policies, access‑control reviews, and breach‑detection logs are consistently enforced.
- Demonstrating robust identity‑and‑access controls can provide defensible audit evidence across frameworks such as NIST CSF 2.0.
Who Is Affected – Adult‑entertainment platforms, any online service that handles user credentials without strong cryptographic protection.
Recommended Actions –
- Immediately replace all plain‑text passwords with salted, iterated hashes (e.g., Argon2, bcrypt).
- Enforce multi‑factor authentication for all privileged accounts.
- Conduct a control‑mapping exercise to verify that credential‑storage policies are documented, monitored, and evidentially logged.
- Initiate continuous monitoring for credential‑theft indicators and prepare breach‑response evidence for audit readiness.
Source: Have I Been Pwned – TNAFlix breach
Technical Notes – The breach appears to have been a result of inadequate password‑storage practices; no specific CVE or exploit was disclosed. Exposed data types: email, IP address, username, plain‑text password. Source: same as above