Adult website Luscious left data of 1M+ users exposed, including user email addresses, location data, the content they uploaded, liked, and shared
A popular hentai porn site that promises anonymity to its 1.1 million users left a user database exposed without a password, allowing anyone to identify users by their email addresses.
Context & Ripple Effects
Luscious marketed anonymity to its users while leaving a database of roughly 1.1 million of them — emails, location data, uploaded and liked content — sitting open on the internet with no password required. That gap between promise and practice is the recurring failure mode in this beat: FriendFinder Networks lost 412M accounts across its adult properties, Brazzers leaked 800K plaintext-password forum accounts, and xHamster data was traded online years earlier.
What distinguishes this incident is that no hack was needed at all — like the later CAM4 and PussyCash exposures in the related coverage, the data was simply left reachable. For an adult site, where the entire product premise is that browsing cannot be tied back to a real identity, an unauthenticated database converts a security lapse into a deanonymization event.
First-order effects
- Luscious's 1.1 million users are directly identifiable by email address alongside their location data and the specific content they uploaded, liked, or shared — breaking the anonymity the site explicitly promised.
Second-order effects
- Combined with email-and-password pairs from earlier adult-site breaches like FriendFinder's and Brazzers', this dataset gives attackers the raw material for credential-stuffing and targeted extortion of users whose identities are now linkable to their viewing habits.
Third-order effects
- If unsecured databases keep exposing adult-platform users — from FriendFinder through Luscious to CAM4 — the industry's anonymity claims will face mounting pressure to become auditable engineering guarantees rather than marketing language, with regulators and payment partners as the likely enforcement levers.
The trend: Adult platforms are shifting from treating privacy as a selling point to being judged on it, as one unsecured-database exposure after another proves their anonymity promises hollow.