10 Million+ Stripchat User Accounts Exposed via Unsecured Database
What Happened
In November 2021 the adult‑live‑cam platform Stripchat left multiple databases publicly accessible and unprotected. By June 2022 more than 10 million records—usernames, email addresses, and IP addresses—appeared on a hacking forum, confirming the breach.
Why It Matters for Compliance & Audit Readiness
- Demonstrates the risk of missing secure‑configuration controls; a continuous control‑assurance program would require documented hardening of all storage assets.
- Highlights the need for continuous monitoring to detect exposed cloud resources before they are harvested.
- Provides a concrete audit‑ready evidence point for data‑handling policies and third‑party risk assessments.
Who Is Affected
- Adult‑entertainment and live‑streaming platforms
- Any online service that stores user credentials (SaaS, social, messaging)
- Organizations that rely on third‑party providers for user authentication
Recommended Actions
- Review your exposure to Stripchat‑related services and any shared infrastructure.
- Validate that secure‑configuration and continuous‑monitoring controls are enforced for all databases and storage buckets.
- Request a detailed incident‑response disclosure from the vendor and update your risk register accordingly.
Technical Notes
- Attack vector: Misconfigured, publicly accessible database containing user records.
- CVEs: None reported.
- Data types exposed: Email addresses, IP addresses, usernames.
Source: https://haveibeenpwned.com/api/v3/breach/Stripchat