AdultFriendFinder: Over 412 million accounts leaked in 2016

An attack on Friend Finder Networks in October 2016 exposed details of more than 412 million accounts, including about 339 million from AdultFriendFinder, with passwords stored in plain text or weak hashes.

What happened

In November 2016 the breach-monitoring service LeakedSource reported that Friend Finder Networks had been hacked in October. The company runs AdultFriendFinder and several adult websites. More than 412 million accounts across the network were exposed, about 339 million of them from AdultFriendFinder. The exposed data included email addresses, passwords, dates of last visits, browser information, IP addresses and membership status. According to LeakedSource, passwords were stored either in plain text or as SHA-1 hashes, and more than 99 percent were cracked. According to The Verge, the company had kept data on 15 million accounts that users had deleted. The company said it had found and fixed a vulnerability, but it did not confirm the breach to the press. It was the second leak in just over a year.

What is documented

• The Guardian and The Verge, citing LeakedSource: 412,214,295 accounts exposed; data included emails, passwords, IP addresses and membership status.
• The Guardian: the company's vice president and senior counsel told ZDNet it had identified and fixed an injection vulnerability.
• The Verge: data on about 15 million deleted accounts was retained.

What has not been established

• The company did not confirm the breach publicly in the sources.
• Who carried out the attack.
• No regulator decision or court ruling is described in these sources.

What this means for you

1. Use a unique password for each dating service, so that a leak does not open your other accounts.
2. Enable two-step verification wherever possible.
3. Assume that "deleted" accounts may still be stored; ask the service to erase your data.