ToonDoo – 6,002,694 User Accounts Compromised in 2019 Data Breach
What Happened — In August 2019 the comic‑strip creation platform ToonDoo suffered a breach that exposed more than six million subscriber records. The stolen data—including email addresses, IPs, usernames, genders, geographic locations and salted password hashes—was later posted on a public hacking forum in November 2019.
Why It Matters for Trust & Control Assurance
- The incident illustrates the risk of weak authentication and inadequate password‑hash storage—exactly the scenario a continuous control‑assurance program monitors and evidences.
- Demonstrating robust access‑control policies, secure credential handling, and regular audit logs satisfies a single VCF control objective that maps to many frameworks (e.g., NIST CSF 2.0).
- Leveraging Verisq’s ACCESS_CONTROLS capability helps you collect defensible evidence that your identity‑management controls are operating as intended.
Who Is Affected – Media‑focused SaaS platforms, online creative tools, and any service that stores user credentials at scale.
Recommended Actions
- Review password‑storage mechanisms (e.g., use salted bcrypt/argon2, enforce strong hashing).
- Validate that privileged access to user databases is limited to least‑privilege accounts and logged.
- Implement continuous monitoring of authentication logs and generate audit‑ready evidence for control‑mapping.
Source: Have I Been Pwned – ToonDoo breach
Technical Notes
- Attack vector: not publicly disclosed; breach likely stemmed from credential compromise or inadequate database protection.
- No specific CVE; data types exposed were email, IP, username, gender, location, and salted password hashes.
Source: same as above