Data of nearly 380K of 12M registered users of porn site xHamster are being traded online, including usernames, emails, and poorly-hashed passwords
Hundreds of thousands of user account details for porn site xHamster are being traded on the digital underground.
Context & Ripple Effects
The xHamster dump lands mid-way through a brutal 2016 for adult-platform security: just weeks earlier, Brazzers' forum was breached and 800K account details leaked with passwords stored in plaintext. The same underground trader ecosystem is involved on the supply side too — the hacker known as Peace, who put 100M+ unencrypted VK records up for sale for one bitcoin, has been running the same playbook against 200M+ alleged Yahoo credentials.
What makes this batch notable is scale relative to exposure: roughly 380K records out of 12M registered users sounds small, but usernames plus emails plus weakly-hashed passwords from an adult site are premium material for extortion and credential reuse, because users have strong incentives to keep the association quiet.
First-order effects
- Affected xHamster users face immediate credential-stuffing and phishing risk wherever they reused those email/password pairs, and the sensitive nature of the site makes them unusually susceptible to extortion.
- xHamster takes a direct trust hit to its registered-user base — the same dynamic that followed the Brazzers leak, where plaintext storage turned a forum compromise into a user-facing privacy event.
Second-order effects
- Every other adult platform now inherits the burden of proving its password storage differs from xHamster's 'poorly-hashed' standard, pushing hashing and breach-response spending across the category.
- Credential brokers like Peace gain fresh inventory to bundle into the large aggregated dumps they already sell — the same resale pipeline visible in the VK and Yahoo offerings.
Third-order effects
- If the pattern holds — Brazzers, then xHamster, and later the CAM4 database exposing 10B+ records and Luscious leaving 1M+ users' data exposed — adult sites emerge as a structurally recurring source of breached credentials, strengthening the case for mandatory breach disclosure and modern authentication norms sector-wide.
- Individual site hacks keep feeding the aggregator market that culminated in offers like the ~617M-record collection from 16 hacked companies, shifting power from the hackers who steal data to the brokers who package and price it.
The trend: Adult platforms are becoming a reliable upstream supply for the stolen-credential resale economy, with weak password storage converting each breach into durable underground inventory.