> series: anatomy_of_a_breach —— part: 053 —— target: livingsocial —— accounts: 50,000,000 —— passwords: bcrypt<span class="cursor-blink">_</span>_
In late April 2013, LivingSocial — the Amazon-backed daily deals website — disclosed that attackers had gained unauthorised access to its customer database, compromising approximately 50 million user accounts. The stolen data included names, email addresses, dates of birth, and password hashes. CEO Tim O'Shaughnessy emailed all affected users advising immediate password changes.
Like Zappos, LivingSocial had implemented bcrypt for password hashing — meaning the stolen hashes were computationally expensive to crack. However, the breach exposed personal information (names, emails, dates of birth) that could be used for phishing and identity theft regardless of password security. The combination of 50 million email addresses and dates of birth — both commonly used as security verification questions by banks and other services — represented a significant identity theft dataset.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping CallLivingSocial's use of bcrypt was commendable — but it did not prevent the breach. bcrypt protects passwords after a database is stolen; it does not prevent the database from being stolen in the first place. The breach underscored the principle of defence in depth: strong password hashing is one layer, but network segmentation, application security, vulnerability management, and continuous monitoring are equally essential layers.
The LivingSocial and Zappos breaches both demonstrate that good password hashing is necessary but not sufficient. A complete security posture requires: application testing to prevent the vulnerabilities attackers exploit for initial access, infrastructure testing to validate network segmentation and database access controls, Cyber Essentials certification for baseline controls, continuous SOC monitoring for early detection, and incident response capability for when prevention fails. Each layer reduces risk; no single layer eliminates it.
Our <a href="/penetration-testing">penetration testing</a> assesses every layer — application, infrastructure, access controls, and monitoring. <a href="/cyber-essentials">Cyber Essentials</a> certifies the baseline. <a href="https://www.socinabox.co.uk">SOC in a Box</a> monitors continuously.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call