Hacker leaks sensitive info of millions of Adult FriendFinder users
Information of over 3.5 million users of dating site Adult FriendFinder has been stolen and leaked online, and is being used by spammers, scammers and phishers, a Channel 4 investigation into the Deep Web has revealed.
According to a researcher known as Teksquisite, the leak was published in mid-April, and consists of 15 spreadsheets containing user information such as name, email address, online handle, password, marital status, sex, race, date of birth, sexual preferences, IP address, country/state, ZIP code, and so on. Credit card data is not included.
Apart from being perfect for personalizing phishing emails, Teksquisite notes that the data can be, in many cases, tied to the users’ real-life identities.
“You can assume that the hacked database is not simply sitting on one forum — it is probably being shared within other Darknet and I2P forums too. With so much data included in the rooted database(s), and even though the majority of email addresses come from free email accounts such as AOL, Gmail, Live, Hotmail, and Yahoo.com — it should be relatively easy to dox a slew of them,” she added.
Given that many of the site’s users are married and/or have sexual preferences that, if publicly revealed, could negatively influence their careers and reputation, it’s more than likely that someone will use the data to blackmail them.
The data was stolen and leaked by a Thai hacker that goes by the handle ROR[RG], who claims that the site’s owners owe his friend nearly a quarter of a milion dollars. He apparently tried to make them pay a ransom of $100,000 not to leak additional data.
According to Steve Ragan, the data is at least 74 days old.
The company behind the site has confirmed that they have initiated an investigation to find out the extent of the breach.
“FriendFinder Networks Inc. has just been made aware of a potential data security issue and understands and fully appreciates the seriousness of the issue. We have already begun working closely with law enforcement and have launched a comprehensive investigation with the help of leading third-party forensics expert, Mandiant, a FireEye Company, the law firm of Holland & Knight, and a global public relations firm that specializes in cyber security,” they stated.
“Until the investigation is completed, it will be difficult to determine with certainty the full scope of the incident, but we will continue to work vigilantly to address this potential issue and will provide updates as we learn more from our investigation. We cannot speculate further about this issue, but rest assured, we pledge to take the appropriate steps needed to protect our customers if they are affected.”