65 Million Tumblr Accounts Exposed in 2013 Data Breach – Emails and Password Hashes Leaked
What Happened – In early 2013 Tumblr’s systems were breached, resulting in the theft of more than 65 million user records. The leaked data included email addresses and passwords stored as salted SHA‑1 hashes, which later appeared for sale on a dark‑web marketplace.
Why It Matters for Trust & Control Assurance
- Highlights the risk of weak password‑hashing algorithms and the need for modern, computationally‑hard hashing (e.g., bcrypt, Argon2).
- Demonstrates why continuous credential‑exposure monitoring and rapid incident documentation are core to a defensible audit trail.
- Reinforces the importance of having a formal password‑reset and user‑notification process to satisfy access‑control objectives across frameworks.
Who Is Affected – Social‑media platforms, any online service that stores user credentials, and downstream businesses that integrate with such services.
Recommended Actions
- Upgrade password storage to a memory‑hard algorithm and retire SHA‑1.
- Force password resets for all affected accounts and communicate the change to users.
- Deploy continuous monitoring for credential leaks (e.g., dark‑web watch, breach‑notification feeds).
- Capture evidence of these controls for audit readiness and compliance reporting.
Source: Have I Been Pwned – Tumblr Breach
Technical Notes
- Attack vector remains undisclosed; the breach likely involved exploitation of a server‑side vulnerability or insider access.
- Exposed data types: email addresses, password hashes (salted SHA‑1).
- No CVE is associated with this incident.
Source: Same as above