AdultFriendFinder was hacked

What happened?

Friend Finder Network Inc is a company that operates a wide range of 18+ services and was hacked in October of 2016 for over 400 million accounts representing 20 years of customer data which makes it by far the largest breach we have ever seen -- MySpace gets 2nd place at 360 million. This event also marks the second time Friend Finder has been breached in two years, the first being around May of 2015.

A list of sites we have verified, how many affected accounts and a brief description are as follows:

• Adultfriendfinder.com
  • 339,774,493 users
  • "World's largest sex & swinger community"
• Cams.com
  • 62,668,630 users
  • "Where adults meet models for sex chat live through webcams"
• Penthouse.com
  • 7,176,877 users
  • Adult magazine akin to Playboy
• Stripshow.com
  • 1,423,192 users
  • Another 18+ webcam site
• iCams.com
  • 1,135,731 users
  • "Free Live Sex Cams"
• Unknown domain

Total: 412,214,295 affected users

How did it happen? They were hacked via a Local File Inclusion exploit and you can read more about the situation when it was initially reported from this link.

After much internal deliberation by the LeakedSource team and for various reasons, we have decided that this data set will not be searchable by the general public on our main page temporarily for the time being*.

*Due to these unique circumstances, understandably skeptical journalists can contact us for undeniable proof. Trust us but independently verify our claims.

Anyone may use any information on this page for free even commercially, provided LeakedSource is given prominent credit and a direct hyperlink back to this website. (Creative Commons License 4.0)

Who are we?

LeakedSource is a breach notification website that specializes in bringing hacking incidents to the public eye. To accomplish this we offer a freemium tool to see if your information has been affected by any hacks we know about. We also offer a proactive FREEnotification service where if we find your email in a future hack, we'll tell you about it.

Sometimes when the incident is important enough, we analyze and blog about it. We also have a tool for businesses to automatically check to see if any of their own customers are reusing a password from a public hack over at our API. Companies can then force change passwords which completely irradicates credential stuffing attacks on their services saving them millions of dollars in customer support costs. It is important for us to state that we are publishers not hackers and you can read more about us on our FAQ. Now onto the details.

Deleted Users... maybe?

While perusing the data we noticed that a significant amount of users had an email in the format of: email@address.com@deleted1.com. Uh oh.

We've seen this situation many times before and it likely means these were users who tried to delete their account but the data is obviously still kept around because you know, we're looking at it. According to a reporter it is impossible to register an account using an email that's formatted this way which means the addition of "@deleted.com" was done behind the scenes by Adult Friend Finder. So counting the amount of emails with "@deleted" near the end, we have 15,766,727 "deleted" accounts in AdultFriendFinder.com.

Passwords

Passwords were stored by Friend Finder Network either in plain visible format or SHA1 hashed (peppered). Neither method is considered secure by any stretch of the imagination and furthermore, the hashed passwords seem to have been changed to all lowercase before storage which made them far easier to attack but means the credentials will be slightly less useful for malicious hackers to abuse in the real world.

At this time we also can't explain why many recently registered users still have their passwords stored in clear-text especially considering they were hacked once before, but here's the breakdown:

• AdultFriendFinder.com
  • 103,070,536 passwords already plainly visible
  • 232,137,460 passwords hashed with SHA1
  • 99.3% of all passwords from this website are now plaintext (cracked).
• Cams.com
  • 21,422,277 passwords already plainly visible
  • 41,209,412 passwords hashed with SHA1
  • 96.8% of all passwords from this website are now plaintext (cracked).
• Penthouse.com
  • 495,720 passwords already plainly visible
  • 6,678,239 passwords hashed with SHA1
  • 99.9% of all passwords from this website are now plaintext (cracked).
• Stripshow.com
  • 342,889 passwords already plainly visible
  • 1,080,303 passwords hashed with SHA1
  • 99.95% of all passwords from this website are now plaintext (cracked).
• iCams.com
  • 272,409 passwords already plainly visible
  • 863,317 passwords hashed with SHA1
  • 99.96% of all passwords from this website are now plaintext (cracked).

Total: 99.0% of all available passwords are now visible in plaintext

We can then create a table of the most commonly used passwords from only the main AdultFriendFinder.com database which provides a reasonable sample of the kind of credentials in use. Hint: They're not good ones.

Rank	Password	Frequency
1	123456	900,420
2	12345	635,995
3	123456789	585,150
4	12345678	145,867
5	1234567890	133,414
6	1234567	112,956
7	password	101,046
8	qwerty	86,050
9	qwertyuiop	43,755
10	987654321	40,627
11	123123	39,614
12	111111	38,848
13	pussy	37,938
14	fuckme	36,008
15	asdfghjkl	35,021
16	000000	34,631
17	fuckyou	34,498
18	abc123	34,080
19	00000	33,796
20	11111	33,263
21	55555	31,524
22	54321	31,278
23	123452	30,111
24	654321	29,624
25	pwd1234	28,061
26	zxcvbnm	27,237
27	iloveyou	24,155
28	qwert	22,499
29	666666	21,629
30	asdfg	20,696
31	0123456789	20,485
32	azerty	19,700
33	0987654321	19,641
34	france	19,559
35	abcd1234	19,056
36	password1	18,677
37	fffff	18,461
38	112233	18,152
39	696969	18,150
40	123321	17,703
41	121212	17,302
42	asdfgh	16,400
43	football	16,080
44	12345678910	16,054
45	abcde	15,789
46	qwerty123	15,286
47	1qaz2wsx	14,885
48	123123123	14,691
49	pakistan	14,173
50	aaaaa	13,543
51	barcelona	13,170
52	fuckoff	12,977
53	bigdick	12,725
54	102030	12,564
55	asshole	12,512
56	7777777	12,280
57	baseball	12,213
58	qazwsx	12,181
59	liverpool	12,129
60	fucker	11,996
61	sexsex	11,956
62	fucking	11,924
63	987654	11,706
64	555555	11,680
65	aaaaaa	11,599
66	abcdef	11,599
67	daniel	11,541
68	0000000000	11,400
69	222222	11,271
70	carlos	11,256
71	superman	11,181
72	teamo	11,044
73	123654	11,032
74	159753	10,995
75	dragon	10,809

We've also hand selected a bunch of the longest real passwords we've managed to crack, obtained from all websites.

Password	Length
pussy.passwordLimitExceeded:07/1	32
gladiatoreetjaimelesexetjaimefum	32
antidisestablishmentarianism	28
pussypussymoneymoneyweedweed	28
1234tellmethatyoulovememore	27
ifyourreadingthisitstoolate	27
12bucklemyshoe34shutthedoor	27
iloveyousomuchdarling123456	27
fuck her right in the pussy	27
killerklownzfromouterspace	26
sexisthesecretofmyenergy	24
thingsyouseeinagraveyard	24
schrodingersfavouritecat	24
mypussyiswetterthanyours	24
dontthinkaboutitchelsea	23
cunninglinguistbackdoor	23
primeministerismanmohan	23
iwilleatyourpussyright	22
who the fuck is alice?	22
protopopicitorescovici	22
youwillneverwalkalone	21
needledickthebugfucer	21
myboyfriendsadickhead	21
ilovemanchesterunited	21
hotsexgirlscomemyway	20
ratsliveonnoevilstar	20
ilovebigdickintheass	20
southafricanmolerat	19
moneyhungrybitches	18
ifuckinghateshayne	18
bigfloppydonkydick	18
werwolfremuslupin	17
kuntwhorebitch123	17
elephantintheroom	17
godstimeisthebest	17
brazilianfartporn	17
carlosfromcancun	16

Emails

Usually people ask us how many .gov and .mil emails exist on sites like this which is easy enough to check. There are 5,650 .gov registered emails on all websites combined and 78,301 .mil emails.

We can also generate a simple table of top email providers used, from AdultFriendFinder.com only. If you review all of our blogs it's easy to see the heavy usage of Yahoo and Hotmail addresses in companies that are older than 2004, the year Gmail was created.

Site Growth and Usage

Sometimes when join dates and last visit dates are available, we can see how popular a website truly is.

AdultFriendFinder.com - Number of users who visited the site in this year, but never came back afterwards.

The last number, 6 million in 2016 would represent the known total amount of users who visited the site in 2016.

Year	Members who never returned after this year
UNKNOWN	81,567,099
1997	36
1998	154
1999	10,166
2000	1,896
2001	93,127
2002	81,170
2003	826,403
2004	1,506,632
2005	699,309
2006	337,792
2007	2,542,016
2008	2,483,046
2009	11,449,232
2010	22,745,563
2011	39,986,839
2012	31,039,071
2013	53,186,359
2014	67,677,193
2015	17,487,269
2016	6,054,113

Cams.com - How many new people registered in each year?

Year	New Members
1998	103
1999	733
2000	636
2001	1,664
2002	8,288
2003	12,783
2004	17,067
2005	184,480
2006	828,922
2007	6,409,584
2008	8,853,411
2009	7,038,754
2010	7,097,596
2011	5,938,875
2012	6,896,421
2013	6,354,311
2014	5,588,085
2015	4,703,541
2016	2,700,272

We can also determine how many Cams.com users joined and never returned to the site (register date = last visit date). That number is 1,084,686 out of 62.6 million which is addmitedly quite impressive on their end, most of the users that come to the site actually use it.

Penthouse.com - How many new people registered in each year?

Data seems to end during the 2014 year, we're not sure why.

Year	New Members
1997	194
1998	1,325
1999	1,790
2000	349
2001	780
2002	1,926
2003	2,552
2004	5,330
2005	238,299
2006	142,855
2007	117,548
2008	1,248,557
2009	712,008
2010	1,315,626
2011	1,608,557
2012	1,113,536
2013	604,809
2014	60,708

Database Schemas

Provided below are the table schemas for (in order), AdultFriendFinder.com, Cams.com, Penthouse.com. These are mostly of interest to IT professionals.

Important Updates on LeakedSource

Much has happened in the last month that we'd like to share.

• Despite LeakedSource helping prior and in a case of "biting the hand that feeds", Twitter decided to suspend us in an effort to curb free speech which as a private company they are more than free to do. Don't expect us to help out the next time we find other Twitter credentials on the dark web. Because of this situation, we are now giving exclusive breach notifications to this news feed. If Twitter decides to ban them as well, we are going to start giving exclusive content to the terrorist group ISIS so they too get banned from Twitter because it seems like that's what it'll take to get Twitter to take action against accounts of those who enjoy cutting the heads off their enemies.


• We now offer a free notification service for users, get proactively notified when you appear in any breaches - Get notified!.


• Companies can cheaply secure their network by using our API. Contact us about this today.


• Journalists that want to be directly emailed every time we add a future breach can let us know over here.

That's it for this blog! As always we have many more interesting breaches to verify and analyze including several additional Silicon Valley tech giants, so check back frequently and remember we always provide quality security news! In December we're also going to be publishing a year in review where we intend to analyze trends over every breach we know about as well as our personal experiences, motivations and predictions going forward. But who reads this far anyway?

LeakedSource Team