Anatomy of a Breach

Anatomy of a Breach: Zappos — 24 Million Accounts and a Masterclass in Breach Response

> series: anatomy_of_a_breach —— part: 037 —— target: zappos —— accounts: 24,000,000 —— passwords: bcrypt_hashed<span class="cursor-blink">_</span>_

Hedgehog Security 31 January 2012 12 min read

24 million accounts breached. But the passwords were properly hashed.

On 15 January 2012, Zappos — the Amazon-owned online shoe and clothing retailer — disclosed that attackers had penetrated its internal network in Kentucky and accessed a database containing the personal information of approximately 24 million customer accounts. The compromised data included names, email addresses, billing and shipping addresses, phone numbers, the last four digits of payment card numbers, and cryptographically hashed passwords.

What distinguished Zappos from the breaches we have examined throughout this series was not what was stolen — but what was protected and how the company responded. Zappos had stored passwords using bcrypt, a deliberately slow hashing algorithm designed to resist brute-force cracking. Full payment card numbers and CVVs were stored in a separate, uncompromised system. And the company's response — CEO Tony Hsieh's immediate email to all 24 million customers, forced password resets, and transparent communication — set a standard for breach response that many larger organisations have since failed to match.


Recommended

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

The controls that limited the damage.

bcrypt Password Hashing
Zappos stored passwords using bcrypt — a key-stretching algorithm that is computationally expensive to crack. Unlike the MD5 hashes at <a href="/blog/anatomy-of-a-breach-hbgary-federal">HBGary</a>, the DES encryption at <a href="/blog/anatomy-of-a-breach-2010-year-review">Gawker</a>, or the plaintext storage at <a href="/blog/anatomy-of-a-breach-lulzsec">Sony Pictures</a>, bcrypt-hashed passwords provide genuine protection even after database exfiltration. Our <a href="/blog/from-the-hacker-desk-cracking-passwords-afternoon">password cracking assessments</a> evaluate whether your password storage would withstand the same test.
Payment Data Segregated
Full credit card numbers and CVVs were stored in a separate system that was not compromised. Only the last four digits were in the breached database. This architectural decision — separating payment data from general customer data — is exactly what <a href="/penetration-testing/pci-dss">PCI DSS</a> mandates and what our infrastructure testing validates.
Immediate Transparent Communication
CEO Tony Hsieh emailed all 24 million customers within hours of confirming the breach. The communication was honest, specific about what was compromised, and included actionable guidance. This stands in stark contrast to the weeks or months of delayed disclosure we have documented at <a href="/blog/anatomy-of-a-breach-sony-psn">Sony</a>, HMRC, and others.
Forced Password Resets
Zappos immediately forced password resets for all 24 million accounts — not just those believed to be compromised. This proactive approach, while disruptive, eliminated the risk of credential reuse attacks from the stolen hashes.

The breach itself was still preventable.

Despite the good practices in password storage and breach response, the breach itself indicated that Zappos' network security had gaps. The attackers gained access to a production database containing 24 million records — suggesting insufficient segmentation, inadequate access controls, or exploitable vulnerabilities in the network path to the database. A penetration test would have assessed whether the database was reachable from attacker-accessible network segments and whether access controls were effective.

The lesson of Zappos is twofold: implement the controls that limit damage when a breach occurs (strong hashing, data segregation, incident response plans), AND implement the controls that prevent the breach from happening in the first place (penetration testing, vulnerability scanning, Cyber Essentials certification, and continuous SOC monitoring). Defence in depth means preparing for both prevention and containment. For incident response planning, UK Cyber Defence helps organisations prepare before a breach occurs — not just respond after one.


Zappos got the response right. Would you?

Our <a href="/penetration-testing">penetration testing</a> prevents breaches. Our <a href="/penetration-testing/web-application">application testing</a> verifies password storage security. <a href="https://www.socinabox.co.uk">SOC in a Box</a> detects intrusions. And <a href="https://www.cyber-defence.io/services/incident-response">UK Cyber Defence</a> helps you plan your response before you need it.

Next Step

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

Related Articles