Public Transport Site Unico Campania Exposes 166 K Email Addresses and Plain‑Text Passwords
What Happened — In August 2020 the website of Unico Campania, the public‑transport portal for the Naples region, was compromised. Attackers extracted a database containing 166,031 user records, each with an email address and the associated password stored in clear text. The data has been widely circulated on underground forums.
Why It Matters for Trust & Control Assurance
- Plain‑text password storage violates basic identity‑and‑access‑control best practices and undermines the evidentiary trail needed for audit readiness.
- Continuous control‑assurance programs require proof that credential protection mechanisms (hashing, salting, MFA) are in place and regularly validated.
- The incident highlights the need for real‑time monitoring of credential exposure and rapid evidence collection to support incident‑response and compliance reporting.
Who Is Affected – Transportation and logistics operators, public‑sector web services, and any organization that stores user credentials without strong cryptographic protection.
Recommended Actions –
- Immediately replace all exposed passwords and enforce a forced password reset for all users.
- Implement salted, computationally‑hard hashing (e.g., bcrypt, Argon2) for all stored passwords.
- Deploy multi‑factor authentication for privileged and consumer accounts.
- Integrate credential‑exposure monitoring into your continuous control‑assurance platform to generate defensible audit evidence.
- Document the incident response steps and update your incident‑response playbook to reflect credential‑leak scenarios.
Source: Have I Been Pwned – Unico Campania breach
Technical Notes – The breach appears to have been achieved via unauthorized access to the web application’s user database; no specific CVE or vulnerability was disclosed. Exposed data: email addresses and clear‑text passwords.