Plain‑Text Passwords Exposed in Tuned Global Breach Affecting 985,586 Accounts
What Happened — In January 2021, data from a 2016 breach of Tuned Global was posted to a public hacking forum. The leak contains 985,586 records with email addresses, names, phone numbers, physical addresses and passwords that were stored in plain text.
Why It Matters for Trust & Control Assurance
- Storing passwords in clear text violates the fundamental control of credential protection that a continuous assurance program monitors.
- The incident underscores the need for immutable evidence that password‑handling policies are enforced and regularly audited.
- Demonstrating defensible controls around credential storage can satisfy multiple framework requirements with a single control objective.
Who Is Affected – SaaS and technology service providers that manage end‑user accounts; their customers whose personal data were exposed.
Recommended Actions – Review and remediate credential storage practices; enforce strong hashing (e.g., bcrypt, Argon2); implement continuous monitoring of access‑control logs and retain evidence for audit readiness. Source: https://haveibeenpwned.com/api/v3/breach/TunedGlobal
Technical Notes – The breach appears to stem from a long‑standing vulnerability in data‑at‑rest protection; passwords were not hashed. No specific CVE is cited. Exposed data types include email, name, phone, address, and clear‑text passwords. Source: https://haveibeenpwned.com/api/v3/breach/TunedGlobal