E-mail addresses, sexual orientations, and other sensitive details from almost four million AdultFriendFinder.com subscribers have been leaked onto the Internet following a hack that rooted the casual dating service, security researchers said.
The cache includes more than 3.8 million unique e-mail addresses of current and former subscribers, Australian security researcher Troy Hunt reported early Friday morning. The data, which is in the form of 15 Microsoft Excel spreadsheets, was first seeded to anonymous sites hosted on the Tor privacy network. It has since spread to sites on the open Internet. Links to sites hosting the data are easily found on Twitter and other social networking sites, (Ars isn't publishing the locations).
The compromise was first reported by British broadcaster Channel 4. In addition to including e-mail addresses and the sexual orientations of users, the data also provided other sensitive information, such as ages, zip codes, and whether the subscriber was seeking an extramarital affair. The trove included information for deleted accounts as well as those still current.
The breach appears to be the one described in an April 13 blog post headlined Hacked! How safe is your data on Adult Sites? In the post, researcher Bev Robb didn't mention Adult Friend Finder by name but did say the breach applied to one of the biggest adult websites on the Internet. Robb wrote:
During a fit of rage, a pissed off hacker (going by the handle ROR[RG]) posted 15 downloadable spreadsheets (in zipped file format with credit card data stripped) to a week-old Darknet forum stating that he had rooted the adult site database. Why? Because they owed his guy approximately $248,000 USD. He bragged that the company and law enforcement could not touch him because he was based in Thailand. His ransom demand was set at $100,000 (50G to begin and 50G to end).
If you combine the ransom demand with the amount owed to the hackers buddy—we are looking at approximately $348,000 USD. If the data breach is genuine (and I am sure it is), there is a ton of personally identifiable information (PII) sitting in a forum on the Darknet that has been viewed 1,756 times. It is unknown how many times the breached data files have been downloaded. Though the files were stripped of credit card data, it is still relatively easy to connect the dots and identify thousands upon thousands of users who subscribe to this adult site.
It's not immediately possible to verify this description. So far, officials from
Adult Friend Finder haven't commented on the trove of data circulating or the circumstances under which it became available.
The breach is the latest reminder that privacy isn't solely a matter of our own individual operational security, but also the operational security of anyone we ever e-mail, text, or do business with. According to Channel 4, the exposed Adult Friend Finder subscribers are already being deluged with waves of spam. No doubt private investigators, jilted spouses, and others are also pouring through it. Affected e-mail addresses can be found using the search service of Hunt's have i been pwned website.
