Wanelo Breach Exposes 23 Million Accounts, Including Password Hashes and Personal Data
What Happened — In December 2018, the digital‑mall platform Wanelo suffered a data breach that exposed 23,165,793 user records. The leaked data included email addresses, passwords stored as MD5 or bcrypt hashes, names, shipping addresses, and IP addresses. The breach materialized on a dark‑web marketplace in April 2019.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of weak credential storage — continuous control‑assurance programs must verify that password hashing meets modern standards (e.g., salted bcrypt, Argon2).
- Highlights the need for ongoing monitoring of credential exposure and rapid evidence collection to support audit readiness.
- Reinforces the importance of documented incident‑response procedures that produce a defensible trail for regulators and partners.
Who Is Affected — Retail and e‑commerce operators, online marketplaces, and any organization that stores consumer credentials and personal shipping information.
Recommended Actions
- Immediately enforce a password‑policy upgrade: replace MD5 hashes, require stronger hashing (bcrypt with appropriate work factor or Argon2), and mandate password resets for all users.
- Deploy multi‑factor authentication (MFA) for account access and integrate MFA logs into your continuous monitoring stack.
- Review and document incident‑response playbooks, ensuring evidence of detection, containment, and remediation is captured for audit purposes.
Technical Notes — The breach involved credential hashes (MD5 and bcrypt) and personal identifiers (email, name, address, IP). No specific vulnerability (CVE) was disclosed; the exposure appears to stem from inadequate password‑storage practices and insufficient protection of user data. Source: Have I Been Pwned – Wanelo Breach