2017 Ancestry RootsWeb breach — 300k credentials (acquired 2012)
Data compromised
Email addresses, plain text passwords
Technical writeup
1000Memories was acquired by Ancestry.com in October 2012. In November 2015, Ancestry's RootsWeb service suffered a data breach that wasn't discovered until late 2017. A file containing approximately 300,000 email addresses and plain text passwords was exposed on a RootsWeb server. Of the compromised credentials, 55,000 email/password combinations were used on both RootsWeb and Ancestry.com.
Root cause
Misconfigured RootsWeb community tools; plain text password storage