FriendFinder Network, the parent company of AdultFriendFinder, Cams.com, Penthouse, and others, has been hacked. Information from 412 million accounts are exposed.
According to LeakedSource, a breach notification site, the hack was done through a local inclusion (LFI) exploit. This allowed hackers to gain access to its database from all sites owned by the company. all FriendFinder Network was hacked through a local file inclusion (LFI) exploit. This allowed the attackers to gain access to the databases of all sites owned by the company.
The LFI flaws were first identified a few weeks before the hack happened. And to make matter worse, FriendFinder Network had failed to properly secure its passwords when many of them were either stored in plaintext with no protection, or just using weak SHA-1 algorithm.
From 412 million user information breached, 339 million of them came from AdultFriendFinder, 62 million from Cams.com, with smaller numbers coming from others in the FriendFinder Network sites.
LeakedSource also revealed that FriendFinder Network actually retained the data of users who had deleted their accounts. "While perusing the data we noticed that a significant amount of users had an email in the format of: [email protected]@deleted1.com."
Other information contained in the breach includes whether or not the user was a VIP member, browser information, the last IP address used, and confirmation on a users purchases. But unlike the previous breach which exposed 3.5 million users data, this one contained no information on sexual preferences.
