13.3 M Yam.com Accounts Exposed in 2013 Breach, Revealing Unsalted MD5 Password Hashes
What Happened – In June 2013 the Taiwanese web service yam.com suffered a data breach that was publicly posted on a hacking forum in 2021. The leak contains 13,258,797 unique records, including email addresses, names, usernames, phone numbers, physical addresses, dates of birth, and unsalted MD5 password hashes.
Why It Matters for Trust & Control Assurance
- The incident highlights a failure to apply strong credential‑storage controls (e.g., salted, computationally‑hard hashing), a core control objective that continuous assurance programs must monitor.
- Demonstrates the need for ongoing evidence that password policies, hashing standards, and access‑control reviews are enforced and auditable.
- Aligns with the Access Controls capability in Verisq’s platform, which helps organizations collect, validate, and present proof of robust credential‑management practices for audit readiness.
Who Is Affected – Primarily users of the Yam.com platform (consumer‑facing web service). The breach impacts any organization that stores similar personal data or relies on weak password‑hashing mechanisms.
Recommended Actions
- Inventory all systems that store password hashes and verify that they use salted, adaptive algorithms (e.g., bcrypt, Argon2).
- Implement continuous monitoring of credential‑storage configurations and generate immutable evidence for audit trails.
- Conduct a gap analysis against the “protect credentials” control objective and remediate any deficiencies.
- Notify affected individuals per applicable data‑protection regulations and enforce mandatory password resets.
Technical Notes – The exposed hashes are unsalted MD5 values, which are trivially cracked with modern GPU rigs. No specific CVE is associated; the root cause is insecure password‑storage design. Source: Have I Been Pwned – Yam breach