FriendFinder Networks, operator of AdultFriendFinder.com, Cams.com, other sites hacked; 412M accounts exposed; LeakedSource could crack 99% of all passwords
Almost every account password was cracked, thanks to the company's poor security practices. Even “deleted” accounts were found in the breach.
Context & Ripple Effects
This is a repeat failure, not a first strike: FriendFinder Networks already lost personal data on 3.9 million Adult FriendFinder users in 2015, including sexual preferences and IP addresses, and the new breach shows the same pattern at a hundred times the scale — 412 million accounts across AdultFriendFinder.com, Cams.com and other sites, with even 'deleted' accounts still present in the data.
What makes this breach different is the password outcome. LeakedSource, which had already demonstrated on the 2012 Last.fm dump that weak hashing means near-total cracking within hours, reports it could crack 99% of the FriendFinder passwords — echoing how quickly Ashley Madison's supposedly bulletproof hashes fell in 2015. The company's storage practices, not just its perimeter, are the story.
First-order effects
- Hundreds of millions of current and former users — including people who believed their accounts were deleted — now have emails, usernames and cracked passwords exposed, with sexual-preference data from the earlier breach suggesting the sensitivity of what is attached to those identities.
- LeakedSource gains its largest single dataset yet for the searchable breach database it sells access to, extending an index that already spans LinkedIn, MySpace and VK.com.
Second-order effects
- LeakedSource's business model — actively cracking passwords and selling lookups rather than just publishing dumps — draws scrutiny that ends with it being taken offline after an alleged police raid, removing a marketplace other buyers had come to rely on.
- Adult-entertainment platforms face forced security overhauls as a category: Brazzers' forum leak of plaintext passwords months earlier and CAM4's later exposure of 10 billion records show buyers and advertisers pricing reputational risk into the whole segment.
Third-order effects
- If weak hashing keeps turning large breaches into total credential losses — Last.fm at 96%, Ashley Madison, now FriendFinder at 99% — regulators and payment partners will treat password storage standards at adult and dating sites as a compliance issue, not an engineering choice.
- The pattern also points toward consolidation of breach data into a few searchable commercial indexes, raising the question of who polices the brokers when the police step in.
The trend: Large consumer breaches are shifting from data theft to total credential compromise, as weak password hashing plus commercial leak-indexing services turns every major dump into a fully searchable weapon.