MobiFriends: Data breach exposed 3.5 million email addresses

In January 2020 user data from the Spanish dating app MobiFriends was stolen and offered on a criminal forum, including email addresses, birth dates and weakly protected passwords.

What happened

In January 2020 data from the Barcelona-based dating app MobiFriends was put up for sale on an underground forum and later shared there for free. The data set held about 3.68 million records, or 3.5 million unique email addresses. It also included usernames, genders, dates of birth and passwords protected with MD5, a weak and outdated method. Have I Been Pwned added the breach to its database so users can check whether they are affected. According to Threatpost, researchers warned that the data could expose users to targeted phishing and extortion. MobiFriends did not answer repeated requests for comment.

What is documented

• Have I Been Pwned: breach in January 2020, 3.5 million unique email addresses, data types exposed.
• Threatpost, reporting analysts' findings: 3,688,060 records, sale on a forum, no response from MobiFriends.

What has not been established

• How the attackers got in.
• Whether any regulator, such as Spain's AEPD, has examined the breach. No decision found.
• Whether users were notified directly.

What this means for you

1. Check your email address on Have I Been Pwned.
2. Change your password anywhere you have reused it.
3. Be wary of emails that use your dating profile to pressure or threaten you.