You got the email. The one that says your password is safe because it was ‘cryptographically hashed.’ You almost believed it. Then you asked the only question that matters — which hash? Was it salted? And the silence on the other end told you everything you needed to know.
On August 3, an attacker broke into Tally’s Metabase analytics dashboard and walked out with user emails and password hashes. Not the forms. Not the answers. Just the keys to the kingdom, casually stored in a tool that should have never had them in the first place.
The breach isn’t the attack. The breach is the design.
Here’s what Tally’s notice actually says: “On August 3, an attacker gained unauthorized access to Metabase, the analytics service we use to see how Tally is used. Through that they reached your email address, and your password as a cryptographic hash. A hash is one-way, so it can’t be turned back into your password.”
Sounds reassuring, right? Except it’s not. Because when someone from the community asked the follow-up — which hash? was it salted? — Tally went radio silent. And that silence is the real story.
You don’t need a cryptography degree to understand why this matters. If they used bcrypt or scrypt with per-user salts, your password is probably fine. If they used unsalted MD5 or SHA1, which is still embarrassingly common, your password is already being cracked by someone’s GPU rig right now. The difference between “you’re safe” and “change every password immediately” is a single technical detail — and they won’t answer it.
Most people will argue about the hashing algorithm. The real failure is that an analytics dashboard had access to the authentication database at all.
This is the uncomfortable truth about modern SaaS. Every tool you use is a potential leak point. Tally wasn’t breached through its form builder — the thing they sell. They were breached through Metabase, the internal analytics tool that was quietly holding credentials it had no business holding. This is what security experts mean when they say your company is only as strong as the most privileged third-party system it silently trusts.
I’ve seen this pattern before. A company gets breached, issues a carefully worded notice, and hopes nobody asks the questions that actually matter. The notice is designed to make you feel safe, not to inform you. The vague language about “cryptographic hashes” is doing a lot of heavy lifting — it sounds technical enough to be reassuring, but it commits to nothing. It’s the security equivalent of “thoughts and prayers.”
Here’s what you should actually do right now, regardless of what Tally says next:
Change your Tally password. Change any password that matches it. If you used Tally credentials anywhere else, treat those as compromised too. And if you’re looking at this and thinking “I use a password manager, I’m fine” — good, but that’s not the point.
Every service you trust is a potential leak. Assume the breach, design your life accordingly.
The uncomfortable reality is that we’ve built a digital world where trust is mandatory and verification is optional. You can’t audit every vendor’s security posture. You can’t know which analytics tools have access to your credentials. You can only control your own behavior — and the most powerful thing you can do is stop pretending that “one-way hashing” means anything when the people saying it won’t tell you which hash they used.
Passwords are the dirty secret of modern security. We’ve known they’re broken for decades, yet we keep layering more systems on top of them, hoping nobody notices the foundation is cracked. Tally’s breach isn’t a failure of encryption. It’s a failure of architecture — and architecture failures are the ones that keep happening, because they’re not bugs to be fixed, they’re decisions that have to be unmade.
The question isn’t whether Tally will answer. The question is whether we’ll keep accepting these hollow reassurances from every vendor that comes knocking with a breach notice. Ask the hard questions. Demand the specifics. And never assume that a hash is a promise.
FAQ
Q: Is my password actually safe if it was hashed?
A: It depends entirely on the hashing algorithm and whether it was salted. If they used bcrypt or scrypt with per-user salts, you're probably fine. If they used unsalted MD5 or SHA1, your password is likely being cracked right now. The fact that Tally won't answer which hash they used is a bad sign.
Q: What should I do if I have a Tally account?
A: Change your Tally password immediately. If you reused that password anywhere else, change those too. Assume the breach is real and your credentials are in the wild. Password managers help mitigate this, but they only work if you never reuse passwords across services.
Q: Isn't this just a minor breach since they didn't get form data?
A: No. The attacker got access to email addresses and password hashes. That's authentication data. The fact that they had to go through an analytics tool to get it means the architecture was flawed — and that flaw could be exploited again in ways you can't predict.