Alleged 24 M‑Record Breach of Dating Site Justdate.com Determined Likely Fabricated
What Happened — An alleged breach of the dating platform Justdate.com surfaced in September 2016, claiming exposure of 24,451,312 user records (email, date of birth, location, name). Subsequent verification by Have I Been Pwned (HIBP) subscribers found only a small fraction of the data accurate, and no users recalled ever registering on the service. The incident has been flagged as fabricated.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous third‑party monitoring to validate breach notifications before they trigger incident‑response or audit actions.
- Highlights the importance of maintaining defensible evidence (original logs, vendor attestations) to prove or refute alleged data exposures.
- Reinforces that a robust vendor‑risk program must include verification steps, not just reliance on external breach feeds.
Who Is Affected — Online dating services, consumer‑facing SaaS platforms, and any organization that consumes third‑party breach intelligence.
Recommended Actions
- Integrate breach‑feed validation into your third‑party risk workflow (e.g., cross‑check with vendor logs, request proof of compromise).
- Document the verification process as audit evidence for SOC 2, ISO 27001, or NIST CSF assessments.
- Update your vendor risk register to reflect the false‑positive status and adjust monitoring thresholds.
Source: Have I Been Pwned – Justdate.com breach record
Technical Notes
- Alleged data: email addresses, dates of birth, geographic locations, names.
- No CVE or exploit disclosed; the claim appears to be a fabricated data dump rather than a technical compromise.
Source: HIBP breach analysis