Adult FriendFinder Data Breach Exposes Nearly 4 Million Sensitive User Records (2015)
What Happened — In May 2015 the adult dating platform Adult FriendFinder was compromised. Attackers extracted and publicly dumped approximately 3,867,997 user accounts. The exposed data set included dates of birth, email addresses, gender, location, IP address, race, relationship status, sexual orientation, spoken languages and usernames.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of insufficient privacy‑control assurance: without documented consent and encryption evidence, organizations cannot readily prove compliance after a leak.
- Highlights the need for continuous monitoring of data‑access logs and encryption status to provide a defensible audit trail.
- Directly maps to the control objective of “privacy and data protection” that satisfies multiple frameworks (e.g., GDPR, NIST CSF) when evidence is collected and maintained.
Who Is Affected — Online dating services, any organization that stores highly personal or sexual‑orientation data, and the millions of individual users whose privacy was compromised.
Recommended Actions
- Conduct a privacy impact assessment and map the exposed data elements to applicable regulations (GDPR, CCPA, etc.).
- Implement strong authentication, encryption at rest, and regular review of access‑logs for sensitive fields.
- Update consent‑capture mechanisms and retain verifiable evidence of user consent for all personal data categories.
Source: Have I Been Pwned – Adult FriendFinder breach
Technical Notes — The exact attack vector was not disclosed; the breach appears to be a classic external compromise. No specific CVE was identified. Data types exposed span both personally identifiable information (PII) and highly sensitive personal attributes. Source: same as above