SafeUM
Home Blog Services Download Help About Recharge

Axarhöfði 14, 110 Reykjavik, Iceland

Iceland - 2015
SafeUM
Blog
Services
Download
Help
About
Recharge
Menu
Archive
TOP Security!
14 Nov 2016

Adult Friend Finder hacked in largest personal data breach on record

Adult dating and pornography site company Friend Finder Networks has been hacked, exposing the private details of over 412 million accounts and making it the largest data breach ever recorded, according to monitoring firm Leaked Source.

The attack, which took place in October, resulted in email addresses, passwords, dates of last visits, browser information, IP addresses and site membership status across sites run by Friend Finder Networks being exposed. It s the biggest breach in terms of number of users since the 2013 leak of 359 million MySpace users’ details.

Friend Finder Networks operates “one of the world’s largest sex hookup” sites Adult Friend Finder, which has “over 40 million members” that log in at least once every two years, and over 339m accounts. It also runs live sex camera site Cams.com, which has over 62m accounts, adult site Penthouse.com, which has over 7m accounts, and Stripshow.com, iCams.com and an unknown domain with more than 2.5m accounts between them.

Friend Finder Networks vice president and senior counsel, Diana Ballou, told: “FriendFinder has received a number of reports regarding potential security vulnerabilities from a variety of sources. While a number of these claims proved to be false extortion attempts, we did identify and fix a vulnerability that was related to the ability to access source code through an injection vulnerability.”

Ballou also said that Friend Finder Networks brought in outside help to investigate the hack and would update customers as the investigation continued, but would not confirm the data breach. Leaked Source, a data breach monitoring service, said of the Friend Finder Networks hack: “Passwords were stored by Friend Finder Networks either in plain visible format or SHA1 hashed (peppered). Neither method is considered secure by any stretch of the imagination.”

The hashed passwords seem to have been altered to be all in lowercase, rather than case specific as entered by the users originally, which makes them easier to break, but possibly less useful for malicious hackers. Among the leaked account details were 78,301 US military email addresses, 5,650 US government email addresses and over 96m Hotmail accounts. The leaked database also included the details of what appear to be almost 16m deleted accounts.

To complicate things further, Penthouse.com was sold to Penthouse Global Media in February. It is unclear why Friend Finder Networks still had the database containing Penthouse.com user details after the sale, and as a consequence exposed their details with the rest of its sites despite no longer operating the property.

It is also unclear who perpetrated the hack. A security researcher known as Revolver claimed to find a flaw in Friend Finder Networks’ security in October, posting the information to a now-suspended Twitter account and threatening to “leak everything” should the company call the flaw report a hoax.

This is not the first time Adult Friend Network has been hacked. In May 2015 the personal details of almost four million users were leaked by hackers, including their login details, emails, dates of birth, post codes, sexual preferences and whether they were seeking extramarital affairs.

David Kennerley, director of threat research at Webroot said: “This is attack on AdultFriendFinder is extremely similar to the breach it suffered last year. It appears to not only have been discovered once the stolen details were leaked online, but even details of users who believed they deleted their accounts have been stolen again. It’s clear that the organisation has failed to learn from its past mistakes and the result is 412 million victims that will be prime targets for blackmail, phishing attacks and other cyber fraud.”

Over 99% of all the passwords, including those hashed with SHA1, were cracked by Leaked Source meaning that any protection applied to them by Friend Finder Networks was wholly ineffective. Leaked Source said: “At this time we also can’t explain why many recently registered users still have their passwords stored in clear-text especially considering they were hacked once before.” Peter Martin, managing director at security firm RelianceACSN said: “It’s clear the company has majorly flawed security postures, and given the sensitivity of the data the company holds this cannot be tolerated.”

Tags:
hackers information leaks
Source:
The Guardian
2371
Other NEWS
3 Jul 2020 safeum news imgage An encrypted messaging service has been infiltrated by police
4 May 2020 safeum news imgage Two-Factor Authentication ​What Is It and Why You Should Use It
12 Dec 2019 safeum news imgage Encryption is under threat - this is how it affects you
4 Nov 2019 safeum news imgage Should Big Decisions Be Based on Data or Your Intuition?
7 Jun 2018 safeum news imgage VPNFilter malware infecting 500,000 devices is worse than we thought
4 Jun 2018 safeum news imgage Hackers target Booking.com in criminal bid to steal hundreds of thousands from customers
1 Jun 2018 safeum news imgage Operator of World's Top Internet Hub Sues German Spy Agency
30 May 2018 safeum news imgage US says North Korea behind malware attacks
29 May 2018 safeum news imgage Facebook and Google targeted as first GDPR complaints filed
25 May 2018 safeum news imgage A new reason to not buy these cheap Android devices
24 May 2018 safeum news imgage Flaws in smart pet devices, apps could come back to bite owners
23 May 2018 safeum news imgage Google sued for 'clandestine tracking' of 4.4m UK iPhone users' browsing data
21 May 2018 safeum news imgage LocationSmart reportedly leaked phone location data onto the web
18 May 2018 safeum news imgage The SEC created its own scammy ICO to teach investors a lesson
17 May 2018 safeum news imgage Thieves suck millions out of Mexican banks in transfer heist
All news
SafeUM
Confidential Terms of Use Our technologies Company
Follow us
Download
SafeUM © Safe Universal Messenger

Axarhöfði 14,
110 Reykjavik, Iceland

Iceland - 2015