40 M+ User Records Exposed in Fling Adult Social Network Breach
What Happened — In 2011 the adult‑focused social platform Fling was breached, and attackers extracted 40,767,652 user records. The data set contained email addresses, passwords stored in plain text, dates of birth, gender, geographic location, phone numbers, sexual orientation, fetishes, usernames, and website activity.
Why It Matters for Trust & Control Assurance —
- Storing passwords in clear text violates basic credential‑protection controls that a continuous assurance program must monitor and evidence.
- The breadth of personal attributes triggers privacy‑risk obligations; organizations need documented data‑classification and handling policies that can be audited.
- Demonstrating that encryption, access‑control reviews, and incident‑response evidence are in place is essential for defensible audit readiness.
Who Is Affected — Adult social‑network operators, any SaaS platform that retains sensitive personal data, and downstream services that may have integrated with Fling’s API.
Recommended Actions —
- Force a password reset for all accounts and enforce strong, multi‑factor authentication.
- Encrypt credentials at rest and verify encryption keys are managed under documented procedures.
- Conduct a credential‑storage audit, map findings to the “protect credentials” control objective, and capture evidence for audit trails.
- Review privacy notices and update data‑handling documentation to reflect the exposure of highly sensitive attributes. Source: https://haveibeenpwned.com/api/v3/breach/Fling
Technical Notes — Attack vector not disclosed; breach appears to be a direct compromise of the database. No CVE is associated. Exposed data types include passwords (plain text), personal identifiers, and sexual preference information. Source: https://haveibeenpwned.com/api/v3/breach/Fling