412 million email addresses have been leaked in this week's AdultFriendFinder hack Credit: -/AdultFriendFinder
By Patrick May
For the second time in as many years, the swinger site AdultFriendFinder (“Hookup, Find Sex or Meet Someone Special Now”) has been hacked, and this time hundreds of millions of accounts have been compromised.
The good news, if you can call it ”good,” is that unlike a similar attack in 2015, which exposed nearly 4 million accounts and included sensitive information like sexual preferences, this time that sort of personal data was not exposed. In a post, ZDNet said it got its hands on a part of the database obtained by breach-notification site LeakedSource and “the data does not appear to contain sexual preference data.”
The not-so-good news is that this time there were more than 412 million accounts exposed, including 339 million accounts from AdultFriendFinder.com, along with over 15 million “deleted” accounts that had never been purged from the site’s databases. And another 62 million accounts were hacked from Cams.com (“Hottest Live Sex Cams”) and 7 million from Penthouse.com (currently featuring “Cougar and Kitten Tales 3”) were stolen.
And the even-more-not-so-good news is that AdultFriendFinder apparently did not adequately beef up its site’s security after being hacked in May 2015. That incident, according to reports at the time, exposed sensitive data that users must enter when signing up for an account. That includes their gender, what gender they’re looking to hook up with, and what specific sort of sexual activity they’re interested in. Some of the suggestions AdultFriendfinder offers in its “tell others about yourself” box include “I like my partners to tell me what to do in the bedroom,” “I tend to be kinky” and “I’m willing to try some light bondage or blindfolds.”
California-based AdultFriendFinder, which describes itself as the “world’s largest sex and swinger community,” did not immediately confirm the hack, though it confirmed it was having recent security issues. “Over the past several weeks, FriendFinder has received a number of reports regarding potential security vulnerabilities from a variety of sources. Immediately upon learning this information, we took several steps to review the situation and bring in the right external partners to support our investigation,” said Diana Ballou, vice president and senior counsel, in an email to ZDNet.
“While a number of these claims proved to be false extortion attempts, we did identify and fix a vulnerability that was related to the ability to access source code through an injection vulnerability,” she said. “FriendFinder takes the security of its customer information seriously and will provide further updates as our investigation continues,” she added.
LeakedSource, which obtained the data but could not determine who was behind it, suggested an underground Russian hacking crew may have been the culprit.
This time, the stolen database included usernames, emails, and passwords of so-called “love rats,” or men who cheat on their partners. The discovery of the hack also put the spotlight on LeakedSource, which describes itself as “a collaboration of data found online in the form of a search engine.
The purpose of the tool is to give users the ability to search and find whether their data is available online or not. We are a full disclosure site so we provide all data to the user so they can be better informed of what data (emails, passwords etc.) have been breached. A simple Google search will reveal downloads of .gz files with thousands of user data. This site’s goal is to make it easy to find where your data has been released publicly such as LinkedIn, MySpace and Dropbox databases. We are not responsible for any data leaks, we just find them for you and our scripts make them searchable.
LeakedSource has not made the database searchable, but it did publish “a breakdown of password frequencies and samples of file schemas from the leaked database to substantiate its claims,” according to a report in The Guardian.
David Kennerley, director of threat research at security software firm Webroot, told the Guardian that “this attack on AdultFriendFinder is extremely similar to the breach it suffered last year…. even details of users who believed they deleted their accounts have been stolen again.”
Kennerly said the most recent hack is even more troubling because it shows that AdultFriendFinder “has failed to learn from its past mistakes and the result is 412 million victims that will be prime targets for blackmail, phishing attacks and other cyber fraud.”