The Largest Breach of 2016: 412 Million FriendFinder Accounts Exposed



FriendFinder Networks, the parent company behind the likes of AdultFriendFinder, Cams, Penthouse, iCams and Stripshow has been hacked, with six databases from the company compromised, according to breach notification website LeakedSource.

A Local File Inclusion (LFI) exploit was all it took for server breaches that led to a mammoth 412,214,295 user-accounts’ credentials to leak online. Alarmingly, 99% of all available passwords gathered from the breach, are visible in plaintext.

CSOOnline reveals that information from the breached databases was circulating online since their compromise in October 2016. The incident itself is likely to have occurred before October 20, 2016 with the last login timestamps for user accounts occur on October 17.

As the publication reports, one researcher identified the LFI flaw and warned AdultFriendFinder about the vulnerability. More specifically, the LFI was discovered in a module on AdultFriendFinder’s production servers. While the researcher followed up the public reveal of the vulnerabilities with a post noting that the issue was resolved, the reality could not have been starker.

The severity of the breach saw the leak of FriendFinder Networks’ source code and public/private key-pairs alongside the databases – which contained email addresses and passwords, stored in plain text or hashed using SHA1 with pepper.

The bemusing and weak encryption habit deployed means that 99% of all websites gained from the FriendFinder Networks databases have been cracked.

Furthermore, LeakedSource was able to determine that a notable number of users had an email in the form of ‘[email protected]’, a clear indicator that the user associated with the account sought to delete the account, while AdultFriendFinder tagged these to-be-deleted accounts with “” A mammoth 16,766,727 so-called deleted accounts were discovered in total.

LeakedSource lays out the startling numbers. The websites that have been targeted, along with the number of compromised user accounts.

  • Adultfriendfinder .com – 339,774,493 users
  • Cams .com – 62,668,630 users
  • Penthouse .com – 7,176,877 users
  • Stripshow .com – 1,423,192 users
  • iCams .com – 1,133,731 users
  • An unknown domain – 35,372 users

Altogether, that’s over a staggering 400 million user accounts or 20 years of customer data leaked during the breach, making it the largest recorded breach this year, firmly scaling the MySpace breach which saw 360 million compromised user accounts. By way of comparing, this particular breach makes the infamous Ashley Madison breach meagre in comparison.

Image from AdultFriendFinder.

Samburaj is the contributing editor at Hacked and keeps tabs on science, technology and cyber security.