Massive 170 Million Account Breach at Adult FriendFinder Exposes Emails, Usernames, and SHA‑1 Password Hashes
What Happened — In October 2016, Friend Finder Networks’ Adult FriendFinder platform suffered a breach that exposed 169,746,810 user records. Leaked data included email addresses, usernames, spoken‑language preferences, and passwords stored as unsalted SHA‑1 hashes.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of weak credential‑storage practices that a continuous control‑assurance program is designed to detect and remediate.
- Highlights the need for auditable evidence that password policies, hashing standards, and multi‑factor authentication are enforced across all user‑facing assets.
- Provides a real‑world case for validating that your organization can produce defensible proof of credential‑protection controls during audits or third‑party reviews.
Who Is Affected – Online dating, social networking, and adult‑entertainment platforms that manage large volumes of user credentials.
Recommended Actions – Review and upgrade password‑hashing algorithms (e.g., migrate to bcrypt, Argon2), enforce MFA for all accounts, implement continuous monitoring for credential leaks, and collect evidence of these controls for audit readiness. Source: [Have I Been Pwned API]
Technical Notes – The breach involved SHA‑1 password hashes, a cryptographic algorithm considered insecure for password storage. No specific vulnerability or exploit was disclosed; the exposure appears to stem from inadequate protection of credential data at rest. Source: [Have I Been Pwned API]