Porn cam network PussyCash leaves ~20GB of personal data, including government IDs, of over 4,000 models exposed in an Amazon S3 bucket for days
Katie Kasunic / vpnMentor :
Context & Ripple Effects
This is the latest entry in a string of adult-platform data failures: Luscious left 1M+ users' data exposed in 2019, and months after this story CAM4 exposed 10B+ records including sexual orientations and payment logs. What distinguishes PussyCash's leak is the payload — government IDs are KYC documents models must submit to work, not optional profile data.
The exposure also echoes an insider variant: reporting later found ex-OnlyFans staff retained access to bank statements and KYC images long after leaving. Together these cases show the adult industry collecting identity documents at scale while failing at both perimeter security and access governance.
First-order effects
- Over 4,000 PussyCash models now face identity-theft and extortion risk from leaked government IDs — uniquely dangerous because the documents link legal identities to adult-work participation.
- PussyCash inherits notification duties, bucket remediation, and likely regulatory scrutiny for leaving ~20GB open on Amazon S3 for days.
Second-order effects
- Rival platforms face pressure to audit their own KYC storage and staff-access controls before researchers or traders find the next bucket, since each exposure raises the reputational cost of hosting models' identity documents.
- Cloud providers like Amazon can point to customer misconfiguration rather than platform fault, but the recurrence of open-bucket leaks across adult sites keeps the shared-responsibility model — and calls for default-safe storage — in the spotlight.
Third-order effects
- If mandatory ID verification keeps expanding across adult platforms while breaches recur, the industry's KYC archives become systemic honeypots, pushing regulators toward data-minimization rules for identity documents rather than just breach-notification penalties.
The trend: Adult platforms are accumulating high-sensitivity identity data faster than they secure it, making misconfigured storage and lax access controls a recurring industry-wide failure mode.