5 Million + Plain‑Text Passwords Exposed from Chinese Dating Site Zhenai.com
What Happened – In December 2011 the online dating platform Zhenai.com suffered a data breach that impacted 5,024,908 user accounts. The leaked dataset contains email addresses and passwords stored in clear‑text. Although the breach is flagged as “unverified,” the data appears authentic.
Why It Matters for Trust & Control Assurance
- Highlights the risk of weak credential‑storage controls that a continuous control‑assurance program is designed to detect and remediate.
- Demonstrates the need for auditable evidence that passwords are hashed, salted, and regularly rotated.
- Underlines the importance of real‑time monitoring of credential exposure to maintain a defensible trust posture. (Capability focus: Access Controls)
Who Is Affected – Consumer‑facing internet services, especially online dating platforms and other SaaS applications that manage large volumes of user credentials.
Recommended Actions
- Replace any clear‑text password storage with industry‑standard salted hashing (e.g., bcrypt, Argon2).
- Enforce periodic password rotation and implement credential‑leak monitoring.
- Document and collect evidence of credential‑storage controls for audit readiness. Source: https://haveibeenpwned.com/api/v3/breach/Zhenai
Technical Notes – Exposed data: email addresses, plaintext passwords. No specific CVE; breach likely stems from inadequate password‑handling processes. Source: https://haveibeenpwned.com/api/v3/breach/Zhenai