TruthFinder Exposes Over 8.1M Customer Records in 2019 Breach
What Happened — In 2019, the public‑records search service TruthFinder suffered a data breach that was publicly disclosed in early 2023. The breach exposed 8,159,573 unique customer records, including email addresses, names, phone numbers and passwords stored as scrypt hashes.
Why It Matters for Trust & Control Assurance —
- Continuous third‑party risk monitoring is essential to detect and remediate gaps in vendor data‑protection controls before exposure occurs.
- Demonstrable evidence of strong encryption and password‑hashing practices supports audit readiness and a defensible control‑assurance posture.
- Ongoing collection of vendor security evidence enables organizations to satisfy a single control objective (vendor oversight) that maps to many frameworks (e.g., NIST CSF, ISO 27001).
Who Is Affected — SaaS providers handling personal data and their downstream customers, especially in the consumer‑facing technology sector.
Recommended Actions — Conduct a formal third‑party risk review of TruthFinder, request up‑to‑date evidence of encryption and password‑hashing controls, and integrate continuous monitoring of vendor security posture into your control‑assurance program. Source: Have I Been Pwned
Technical Notes — The breach originated in 2019; data types exposed were email addresses, names, phone numbers and passwords stored as scrypt hashes. No specific vulnerability or attack vector was disclosed. Source: HIBP breach details