1 article with this tag
A server vulnerability was exploited for unauthorized access, and ~4.8 million records (names, emails, login passwords, dates of birth, including withdrawn customers) leaked. The decisive failure was that login passwords were stored unencrypted, in plaintext. Once leaked, they were immediately usable and could be used for account takeover on other sites where people reused them. Defend by storing passwords as a one-way salted hash, holding no data you don't need, patching vulnerabilities, and preparing for reuse (2FA).