1.37 M User Accounts Breached at Adult Site Eroticy, Including Plain‑Text Passwords
What Happened — In mid‑2016 a breach of the adult‑content platform Eroticy exposed 1,370,175 user records. The leaked dataset contained email addresses, IPs, names, phone numbers, physical addresses, usernames, payment histories, website activity, and plain‑text passwords. The exact cause of the breach has not been publicly confirmed.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of inadequate credential storage and weak access‑control policies—exactly the scenario a continuous control‑assurance program monitors.
- Highlights the need for defensible evidence that password handling meets industry‑accepted hashing and MFA requirements.
- Provides a real‑world data point for third‑party risk assessments when evaluating vendors that handle sensitive personal data.
Who Is Affected – Online adult‑entertainment services and any organization that stores user‑generated credentials without strong cryptographic protection.
Recommended Actions –
- Verify that all stored passwords use salted, adaptive hashing (e.g., Argon2, bcrypt, scrypt).
- Deploy multi‑factor authentication for user logins and privileged accounts.
- Conduct a credential‑storage audit and map findings to the “protect credentials” control objective in your assurance framework.
- Implement continuous monitoring of authentication logs for anomalous access patterns.
Source: Have I Been Pwned – Eroticy breach
Technical Notes – The breach data surfaced on public dump sites in late 2016. No specific vulnerability (CVE) has been disclosed; the attack vector remains unknown. Exposed data types include personally identifiable information (PII) and clear‑text passwords, raising immediate credential‑theft risk.
Source: same as above