WedMeGood Data Breach Exposes 1.3M Customer Records Including Password Hashes
What Happened — In January 2021 the Indian wedding‑planning platform WedMeGood suffered a data breach that released ≈ 41.5 GB of information covering 1,306,723 user accounts. The exposed data set includes email addresses, physical and mailing addresses, names, genders, phone numbers and password hashes. The breach was disclosed to Have I Been Pwned by dehashed.com.
Why It Matters for Trust & Control Assurance
- Highlights the need for continuous monitoring of credential storage practices and proof of strong hashing, salting and access restrictions.
- Demonstrates why documented consent, data‑minimization and privacy‑by‑design controls are essential for audit‑ready evidence.
- Shows how a defensible incident‑response trail and evidence collection can satisfy multiple regulatory frameworks in one control objective.
Who Is Affected
- Consumer‑focused online services (e.g., wedding‑planning, event‑booking platforms).
- Any organization that stores personally identifiable information (PII) and password credentials.
Recommended Actions
- Conduct a privacy impact assessment and map exposed fields to consent, retention and deletion policies.
- Verify that password hashes use industry‑recommended algorithms (e.g., bcrypt, Argon2), enforce MFA, and force credential rotation for all affected users.
- Capture remediation steps, policy updates and evidence of monitoring in a centralized Trust Center for audit readiness.
Technical Notes
- Attack Vector: Unknown – breach disclosed via third‑party data‑leak repository.
- Data Types Exposed: Email, name, gender, phone number, physical address, password hashes.
- Relevant CVEs: None reported; breach appears to stem from data‑exfiltration rather than a disclosed software flaw.