Youku Breach Exposes 92 Million Email Addresses and MD5 Password Hashes
What Happened
In late 2016 the Chinese video‑streaming service Youku suffered a data breach that released the credentials of 91,890,110 user accounts. The leaked dataset, now listed on Have I Been Pwned, contains email addresses and MD5‑hashed passwords.
Why It Matters for Compliance & Audit Readiness
- Demonstrates the risk of weak password‑storage algorithms; a continuous control‑assurance program should enforce modern hashing (e.g., bcrypt, Argon2) and regularly verify algorithm compliance.
- Highlights the need for vendor‑risk monitoring that captures credential‑exposure events and forces timely evidence collection for audit trails.
- Shows how a defensible incident‑response process, with documented detection and disclosure steps, reduces regulatory impact and supports NIST CSF Identify‑Protect‑Detect functions.
Who Is Affected
- Online video‑streaming platforms and media‑hosting services.
- Any organization that integrates Youku’s authentication APIs or shares user‑account data with the service.
- End‑users whose email addresses and password hashes were compromised.
Recommended Actions
- Review your exposure to Youku‑related data (e.g., shared authentication, third‑party login).
- Validate that monitoring controls (SIEM, credential‑leak detection) flagged the breach and that evidence is retained for audit.
- Request a detailed incident‑response disclosure from Youku to understand root cause and remediation steps.
- Force password resets for any accounts that may have reused Youku credentials; enforce strong password policies and multi‑factor authentication.
- Update password‑storage standards to eliminate MD5 and adopt memory‑hard hashing algorithms.
Technical Notes
- Attack vector: Compromised database; exact exploitation method not publicly disclosed.
- CVEs: None reported.
- Data types exposed: Email addresses, MD5 password hashes (plaintext passwords not disclosed).
Source: https://haveibeenpwned.com/api/v3/breach/Youku