23.9M Zoosk User Accounts Exposed in 2020 Data Breach
What Happened — In January 2020 the online dating service Zoosk suffered a data breach that was later posted on public hacking forums. The leak included 23,927,853 unique email addresses and a rich set of personal attributes (gender, sexual orientation, political views, ethnicity, income, education, relationship status, etc.). MD5 password hashes were also present in the initial dump, though they were later removed from the released files.
Why It Matters for Trust & Control Assurance —
- The incident is a textbook example of why continuous privacy‑control monitoring and documented consent are essential for audit readiness.
- It highlights the risk of inadequate data‑handling policies and the need for defensible evidence that personal data is protected in line with GDPR‑style obligations.
- Leveraging a consent‑management capability such as CookiePLUS can provide the audit‑ready logs and policy enforcement required to mitigate similar exposures.
Who Is Affected — Consumer‑facing SaaS platforms (online dating, social networking) and any digital service that collects sensitive personal attributes.
Recommended Actions —
- Conduct a privacy‑control gap assessment against GDPR/CCPA requirements.
- Deploy consent‑management tooling to capture, store, and evidence user consent for data collection.
- Replace weak password hashing (MD5) with modern, salted algorithms and rotate credentials.
- Document the incident‑response process and retain evidence for future audits. Source: [Have I Been Pwned – Zoosk 2020 Breach]
Technical Notes — Attack vector has not been publicly disclosed; the breach appears to stem from unauthorized database access. Exposed data types include dates of birth, education, income, political views, sexual orientation, and more. MD5 password hashes were initially part of the dump. Source: [HIBP API]