MobiFriends Dating App Breach Exposes 3.5M User Records Including MD5 Password Hashes
What Happened — In January 2020 the Barcelona‑based dating app MobiFriends suffered a data breach that exposed 3,512,952 user accounts. The compromised data set contained email addresses, usernames, genders, dates of birth, and MD5‑hashed passwords.
Why It Matters for Trust & Control Assurance
- The incident highlights a gap in credential protection – weak hashing (MD5) and inadequate storage controls are exactly the weaknesses a continuous control‑assurance program seeks to detect and remediate.
- Demonstrates the need for ongoing evidence collection around password‑policy enforcement and access‑control monitoring to provide a defensible audit trail.
- Aligns with the control objective of “secure credential lifecycle management,” which maps to multiple frameworks (e.g., NIST CSF Identify & Protect, ISO 27001 A.9).
Who Is Affected – Consumer‑facing mobile applications (Tech SaaS), dating‑service providers, and any organization that stores user credentials without strong cryptographic safeguards.
Recommended Actions
- Conduct an immediate review of password‑storage mechanisms; replace MD5 hashes with a modern, adaptive algorithm such as bcrypt, Argon2, or PBKDF2.
- Enforce credential rotation for affected users and notify them of the breach per applicable privacy regulations.
- Implement continuous monitoring of credential‑management controls and capture evidence for audit readiness.
Source: Have I Been Pwned – MobiFriends breach
Technical Notes – Attack vector not publicly disclosed; breach likely stemmed from a server‑side data leak or inadequate database protection. No specific CVE is associated. Exposed data types: email, username, gender, date of birth, MD5 password hash. Source: same as above