Mate1.com Data Breach Exposes 27.3 M Users’ Personal Details and Plain‑Text Passwords
What Happened — In February 2016 the dating service Mate1.com suffered a data breach that disclosed the records of 27,393,015 subscribers. The exposed data set includes names, email addresses, dates of birth, income levels, sexual fetishes, and passwords that were stored in plain text.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk when sensitive data is not protected by encryption or strong hashing, a control gap that continuous‑control‑assurance programs are built to detect and remediate.
- Highlights the need for ongoing evidence collection on data‑storage configurations so auditors can see a defensible trail of due‑diligence.
- Shows how a single misconfiguration can cascade into a massive privacy incident, underscoring the value of a control‑mapping capability that ties findings to multiple framework objectives.
Who Is Affected — Online dating platforms, consumer‑focused SaaS providers, and any organization that stores personally identifiable information without proper cryptographic safeguards.
Recommended Actions
- Conduct an immediate inventory of all password storage mechanisms and replace plain‑text storage with industry‑standard salted hashing (e.g., bcrypt, Argon2).
- Map data‑protection controls to the Verisq Common Framework (VCF) objectives for encryption, access control, and monitoring; collect evidence for audit readiness.
- Update incident‑response playbooks to include notification obligations for personal‑data breaches and perform a post‑incident risk assessment.
Source: Have I Been Pwned – Mate1 breach
Technical Notes — The breach exposed a wide range of personal attributes (e.g., astrological signs, drug habits, political views) and passwords stored in clear text. No specific CVE was disclosed; the root cause appears to be insecure data‑storage practices. Source: same as above