CityJerks Adult Site Breach Exposes 177,554 User Records, Including Password Hashes
What Happened – In early 2023 the adult‑oriented “mutual masturbation” platform CityJerks suffered a breach that released the personal data of 177,554 users. The dump contained email addresses, usernames, dates of birth, sexual orientation, geographic location, IP addresses, private messages, profile photos, and passwords stored as salted MD5 hashes. The data was later posted on a public hacking forum.
Why It Matters for Trust & Control Assurance
- The incident illustrates the risk of weak credential storage (salted MD5) and the need for robust identity‑and‑access controls that enforce strong hashing algorithms and regular credential‑rotation policies.
- Continuous control‑assurance programs can surface insecure password‑handling practices before they are exploited, providing defensible evidence for auditors and regulators.
- Demonstrating that you monitor and remediate credential‑management controls aligns with the Access Control objective in the Verisq Common Framework and maps to multiple standards (e.g., NIST CSF 2.0, ISO 27001).
Who Is Affected – Online adult‑content platforms, dating‑app providers, and any SaaS service that stores user‑generated personal data and credentials.
Recommended Actions
- Conduct an immediate password‑hash audit: replace MD5‑based hashes with a modern, memory‑hard algorithm (e.g., Argon2, bcrypt, scrypt).
- Verify that password‑storage policies are documented, enforced, and evidence‑collected for audit readiness.
- Implement continuous monitoring of credential‑management controls and generate periodic compliance reports.
Source: Have I Been Pwned – CityJerks breach
Technical Notes
- Data exposure included salted MD5 password hashes, which are considered weak against modern cracking techniques.
- No specific vulnerability (CVE) was disclosed; the breach vector remains unknown.
Source: same as above