FriendFinder Networks breach

On 13 November 2016, security researchers revealed that FriendFinder Networks (FFN) — operator of AdultFriendFinder, Cams.com, Penthouse.com, and related adult and dating sites — had been breached, exposing 412 million accounts. It ranked as the largest disclosed breach of 2016 and one of the most sensitive ever, given the explicitly adult nature of the services involved.

What happened

The intrusion stemmed from a local file inclusion (LFI) vulnerability, a flaw that lets an attacker cause a web server to execute or expose files it should not. A researcher operating under the handle "Revolver" had publicized the vulnerability in October 2016; attackers used it to reach FFN's databases and exfiltrate the contents of six databases spanning the company's networks, including current and historical user records.

The data-handling practices behind those databases compounded the damage. According to analysis of the dump, passwords were stored either in plain text or as unsalted SHA-1 hashes, with the SHA-1 values computed over lowercased passwords. Researchers reported that roughly 99 percent of all passwords in the dataset were ultimately crackable. The breach also revealed that around 15 million accounts users had "deleted" were never actually purged and remained in FFN's systems.

Impact

• 412,214,295 accounts were exposed across FFN's properties, with roughly 339 million tied to AdultFriendFinder alone — the single largest site in the haul.
• Exposed fields included usernames, email addresses, passwords (plain text or weak SHA-1), IP addresses, and site-membership details that could reveal participation in adult services.
• Of the AdultFriendFinder passwords, more than 103 million were stored in plain text and roughly 232 million as unsalted SHA-1.
• The presence of supposedly deleted accounts meant former users who believed they had erased their data were still exposed — a particular concern for a platform whose mere association carried reputational and blackmail risk.
• This was FriendFinder Networks' second major breach in just over a year, following a 2015 incident that exposed several million AdultFriendFinder accounts.

Why it matters

The FriendFinder breach is the canonical example of sensitive-data exposure compounded by negligent storage. Plain-text passwords and unsalted SHA-1 in 2016 — years after both LinkedIn and MySpace had demonstrated the consequences — reflected a fundamental failure to adopt basic password-hashing standards. The retention of "deleted" accounts violated a core user expectation and highlighted the gap between deletion as a UI action and actual data erasure.

Because the affected sites dealt in intimate and adult content, the breach carried outsized extortion and reputational risk for victims, beyond the credential-stuffing danger common to all leaks. It remains a reference case for why platforms handling sensitive personal data must combine modern cryptographic storage, prompt patching of web-application flaws, and genuine data-deletion practices — and for the heightened harm when any of those fail.