Over the past year, that have been an increasing number of database and server breaches. It seems like no one can properly secure themselves against a motivated attacker. In the latest assault, AdultFriendFinder and parent company Friend Finder Network have suffered one of the largest breaches to date. In total, the latest attack has revealed the account information for over 400 million users.
Combined, the adult properties have exposed about 412 million user accounts. The breakdown is 339 million accounts were stolen from AdultFriendFinder.com, 62 million accounts from Cams.com and 7 million from Penthouse.com. The most egregious breach is for 15 million users of AdultFriendFinder who had deleted their accounts but whose records have not yet been purged from the database.
For users who have been compromised, their login email, last login IP and passwords have all been aired out. This may lead to some compromising situations as associates of these users find out about the accounts. Unlike the last beach, at least the users sexual preferences were not revealed.
More troubling for the internet community as a whole are the passwords. Most were stored using the inadequate SHA1 or just in plaintext, making it trivial for attacks to reuse. This will no doubt provide fodder for future dictionary attacks, making users who reuse or only make minor deviations to their passwords vulnerable. Needless to say, for those of you with accounts, now would be the time to change the passwords on any other sites you may have used it on.
