Ulmon Travel App Exposes 777,769 User Accounts in 2020 Data Breach
What Happened — In January 2020 the Ulmon travel‑app platform suffered a breach that released 777,769 unique user records. The dump contained email addresses, full names, phone numbers, bios, social‑media profile IDs and password hashes stored with bcrypt. The data was later posted on a public hacking forum.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of inadequate credential protection; continuous monitoring of password‑storage controls is a core assurance activity.
- Highlights the need for documented evidence that password hashing algorithms meet industry‑accepted strength and that salts are unique.
- Shows why an auditable incident‑response process and proof of due‑diligence are essential for defending against regulatory scrutiny.
Who Is Affected – Consumer‑facing SaaS travel applications, broader mobile‑app providers handling personal data, and any organization that stores user credentials.
Recommended Actions – Review and harden password‑storage policies (ensure strong bcrypt cost, unique salts, and periodic re‑hashing), implement multi‑factor authentication, and update your incident‑response playbook with evidence‑collection checkpoints. Source: https://haveibeenpwned.com/api/v3/breach/Ulmon
Technical Notes – The breach appears to stem from unauthorized access to the user database; no specific CVE is cited. Exposed data types include personally identifiable information (PII) and bcrypt password hashes. Source: https://haveibeenpwned.com/api/v3/breach/Ulmon