SQL Injection Breach Exposes 453K Yahoo Accounts and Plain‑Text Passwords
What Happened — In July 2012 Yahoo’s “Voices” publishing platform was compromised via a classic SQL‑injection flaw. Attackers extracted 453,427 usernames and passwords that were stored in plain text.
Why It Matters for Trust & Control Assurance
- Highlights the risk of inadequate input‑validation controls—a core control objective that continuous‑monitoring programs must evidence.
- Plain‑text credential storage violates best‑practice password‑management controls, undermining audit‑ready proof of secure authentication.
- Demonstrates the need for documented incident‑response evidence to show timely detection and remediation.
Who Is Affected – Online publishing services, internet‑based SaaS platforms, and any organization that stores user credentials without proper hashing.
Recommended Actions – Conduct a full web‑application code review for injection flaws, enforce salted hashing for all passwords, rotate compromised credentials, and capture remediation steps as audit evidence. Source: Have I Been Pwned – Yahoo Breach
Technical Notes – Attack vector: SQL injection exploiting unsanitized input fields. No CVE was assigned (legacy 2012 incident). Exposed data: email addresses and clear‑text passwords. Source: same as above