Sexual secrets for hundreds of millions exposed in largest hack of 2016

November 13th, 2016



What happened? Friend Finder Network Inc is a company that operates a wide range of 18+ services and was hacked in October of 2016 for over 400 million accounts representing 20 years of customer data which makes it by far the largest breach we have ever seen -- MySpace gets 2nd place at 360 million. This event also marks the second time Friend Finder has been breached in two years, the first being around



A list of sites we have verified, how many affected accounts and a brief description are as follows:

Adultfriendfinder.com 339,774,493 users "World's largest sex & swinger community"

Cams.com 62,668,630 users "Where adults meet models for sex chat live through webcams"

Penthouse.com 7,176,877 users Adult magazine akin to Playboy

Stripshow.com 1,423,192 users Another 18+ webcam site

iCams.com 1,135,731 users "Free Live Sex Cams"

Unknown domain 35,372 users

Total: 412,214,295 affected users



How did it happen? They were hacked via a Local File Inclusion exploit and you can read more about the situation when it was initially reported from



After much internal deliberation by the LeakedSource team and for various reasons, we have decided that this data set will not be searchable by the general public on our main page temporarily for the time being*.



*Due to these unique circumstances, understandably skeptical journalists can contact us for undeniable proof. Trust us but independently verify our claims.



Anyone may use any information on this page for free even commercially, provided LeakedSource is given prominent credit and a direct hyperlink back to this website. (



Friend Finder Network Inc is a company that operates a wide range of 18+ services and was hacked in October of 2016 for over 400 million accounts representing 20 years of customer data which makes it by far the largest breach we have ever seen -- MySpace gets 2nd place at 360 million. This event also marks the second time Friend Finder has been breached in two years, the first being around May of 2015 A list of sites we have verified, how many affected accounts and a brief description are as follows:How did it happen? They were hacked via a Local File Inclusion exploit and you can read more about the situation when it was initially reported from this link *Due to these unique circumstances, understandably skeptical journalists can contact us for undeniable proof. Trust us but independently verify our claims.Anyone may use any information on this page for free even commercially, provided LeakedSource is givencredit and ahyperlink back to this website. ( Creative Commons License 4.0

Who are we? LeakedSource is a breach notification website that specializes in bringing hacking incidents to the public eye. To accomplish this we offer a FREE



Sometimes when the incident is important enough, we LeakedSource is a breach notification website that specializes in bringing hacking incidents to the public eye. To accomplish this we offer a freemium tool to see if your information has been affected by any hacks we know about. We also offer a proactive notification service where if we find your email in a future hack, we'll tell you about it.Sometimes when the incident is important enough, we analyze and blog about it . We also have a tool for businesses to automatically check to see if any of their own customers are reusing a password from a public hack over at our API . Companies can then force change passwords which completely irradicates credential stuffing attacks on their services saving them millions of dollars in customer support costs. It is important for us to state that we are publishers not hackers and you can read more about us on our FAQ . Now onto the details.

Deleted Users... maybe? While perusing the data we noticed that a significant amount of users had an email in the format of: email@address.com@deleted1.com. Uh oh.



We've seen this situation many times before and it likely means these were users who tried to delete their account but the data is obviously still kept around because you know, we're looking at it. According to a reporter it is impossible to register an account using an email that's formatted this way which means the addition of "@deleted.com" was done behind the scenes by Adult Friend Finder. So counting the amount of emails with "@deleted" near the end, we have 15,766,727 "deleted" accounts in AdultFriendFinder.com.

Passwords Passwords were stored by Friend Finder Network either in plain visible format or SHA1 hashed (peppered). Neither method is considered secure by any stretch of the imagination and furthermore, the hashed passwords seem to have been changed to all lowercase before storage which made them far easier to attack but means the credentials will be slightly less useful for malicious hackers to abuse in the real world.



At this time we also can't explain why many recently registered users still have their passwords stored in clear-text especially considering they were hacked once before, but here's the breakdown: AdultFriendFinder.com 103,070,536 passwords already plainly visible 232,137,460 passwords hashed with SHA1 99.3% of all passwords from this website are now plaintext (cracked).

Cams.com 21,422,277 passwords already plainly visible 41,209,412 passwords hashed with SHA1 96.8% of all passwords from this website are now plaintext (cracked).

Penthouse.com 495,720 passwords already plainly visible 6,678,239 passwords hashed with SHA1 99.9% of all passwords from this website are now plaintext (cracked).

Stripshow.com 342,889 passwords already plainly visible 1,080,303 passwords hashed with SHA1 99.95% of all passwords from this website are now plaintext (cracked).

iCams.com 272,409 passwords already plainly visible 863,317 passwords hashed with SHA1 99.96% of all passwords from this website are now plaintext (cracked).

Total: 99.0% of all available passwords are now visible in plaintext



We can then create a table of the most commonly used passwords from only the main AdultFriendFinder.com database which provides a reasonable sample of the kind of credentials in use. Hint: They're not good ones.



Rank Password Frequency 1 123456 900,420 2 12345 635,995 3 123456789 585,150 4 12345678 145,867 5 1234567890 133,414 6 1234567 112,956 7 password 101,046 8 qwerty 86,050 9 qwertyuiop 43,755 10 987654321 40,627 11 123123 39,614 12 111111 38,848 13 pussy 37,938 14 fuckme 36,008 15 asdfghjkl 35,021 16 000000 34,631 17 fuckyou 34,498 18 abc123 34,080 19 00000 33,796 20 11111 33,263 21 55555 31,524 22 54321 31,278 23 123452 30,111 24 654321 29,624 25 pwd1234 28,061 26 zxcvbnm 27,237 27 iloveyou 24,155 28 qwert 22,499 29 666666 21,629 30 asdfg 20,696 31 0123456789 20,485 32 azerty 19,700 33 0987654321 19,641 34 france 19,559 35 abcd1234 19,056 36 password1 18,677 37 fffff 18,461 38 112233 18,152 39 696969 18,150 40 123321 17,703 41 121212 17,302 42 asdfgh 16,400 43 football 16,080 44 12345678910 16,054 45 abcde 15,789 46 qwerty123 15,286 47 1qaz2wsx 14,885 48 123123123 14,691 49 pakistan 14,173 50 aaaaa 13,543 51 barcelona 13,170 52 fuckoff 12,977 53 bigdick 12,725 54 102030 12,564 55 asshole 12,512 56 7777777 12,280 57 baseball 12,213 58 qazwsx 12,181 59 liverpool 12,129 60 fucker 11,996 61 sexsex 11,956 62 fucking 11,924 63 987654 11,706 64 555555 11,680 65 aaaaaa 11,599 66 abcdef 11,599 67 daniel 11,541 68 0000000000 11,400 69 222222 11,271 70 carlos 11,256 71 superman 11,181 72 teamo 11,044 73 123654 11,032 74 159753 10,995 75 dragon 10,809



We've also hand selected a bunch of the longest real passwords we've managed to crack, obtained from all websites.



Password Length pussy.passwordLimitExceeded:07/1 32 gladiatoreetjaimelesexetjaimefum 32 antidisestablishmentarianism 28 pussypussymoneymoneyweedweed 28 1234tellmethatyoulovememore 27 ifyourreadingthisitstoolate 27 12bucklemyshoe34shutthedoor 27 iloveyousomuchdarling123456 27 fuck her right in the pussy 27 killerklownzfromouterspace 26 sexisthesecretofmyenergy 24 thingsyouseeinagraveyard 24 schrodingersfavouritecat 24 mypussyiswetterthanyours 24 dontthinkaboutitchelsea 23 cunninglinguistbackdoor 23 primeministerismanmohan 23 iwilleatyourpussyright 22 who the fuck is alice? 22 protopopicitorescovici 22 youwillneverwalkalone 21 needledickthebugfucer 21 myboyfriendsadickhead 21 ilovemanchesterunited 21 hotsexgirlscomemyway 20 ratsliveonnoevilstar 20 ilovebigdickintheass 20 southafricanmolerat 19 moneyhungrybitches 18 ifuckinghateshayne 18 bigfloppydonkydick 18 werwolfremuslupin 17 kuntwhorebitch123 17 elephantintheroom 17 godstimeisthebest 17 brazilianfartporn 17 carlosfromcancun 16 Passwords were stored by Friend Finder Network either in plain visible format or SHA1 hashed (peppered). Neither method is considered secure by any stretch of the imagination and furthermore, the hashed passwords seem to have been changed to all lowercase before storage which made them far easier to attack but means the credentials will be slightly less useful for malicious hackers to abuse in the real world.At this time we also can't explain why many recently registered users still have their passwords stored in clear-text especially considering they were hacked once before, but here's the breakdown:We can then create a table of the most commonly used passwords from only the main AdultFriendFinder.com database which provides a reasonable sample of the kind of credentials in use. Hint: They're not good ones.We've also hand selected a bunch of the longest real passwords we've managed to crack, obtained from all websites.

Emails Usually people ask us how many .gov and .mil emails exist on sites like this which is easy enough to check. There are 5,650 .gov registered emails on all websites combined and 78,301 .mil emails.



We can also generate a simple table of top email providers used, from AdultFriendFinder.com only. If you review all of our blogs it's easy to see the heavy usage of Yahoo and Hotmail addresses in companies that are older than 2004, the year Gmail was created.

Rank Email Domain Frequency 1 @hotmail.com 96,487,200 2 @yahoo.com 74,563,930 3 @gmail.com 61,754,102 4 @aol.com 9,086,506 5 @hotmail.fr 5,640,471 6 @live.com 4,324,630 7 @yahoo.fr 3,301,523 8 @yahoo.com.tw 3,026,680 9 @hotmail.co.uk 2,814,063 10 @ymail.com 2,642,879 11 @msn.com 2,222,420 12 @breakthru.com 2,215,865 13 @rediffmail.com 2,076,126 14 @live.fr 1,862,694 15 @yahoo.co.in 1,852,173 16 @yahoo.co.uk 1,731,497 17 @yahoo.com.br 1,709,304 18 @hotmail.es 1,680,818 19 @hotmail.it 1,666,715 20 @libero.it 1,379,122 21 @web.de 1,242,285 22 @yahoo.in 1,234,240 23 @outlook.com 1,225,885 24 @yahoo.es 1,204,253 25 @rocketmail.com 1,084,346 26 @comcast.net 978,480 27 @bol.com.br 900,003 28 @gmx.de 852,200 29 @yahoo.com.mx 784,632 30 @yahoo.it 683,752 31 @mail.com 675,590 32 @live.co.uk 646,636 33 @live.com.mx 644,434 34 @hotmail.de 630,410 35 @yahoo.co.id 580,495 36 @yahoo.ca 579,302 37 @yahoo.de 578,757 38 @sbcglobal.net 573,936 39 @orange.fr 563,015 40 @live.it 560,782 41 @ig.com.br 523,142 42 @googlemail.com 510,939 43 @aim.com 497,700 44 @yahoo.com.ar 464,441 45 @abv.bg 418,401 46 @att.net 415,071 47 @alice.it 395,113 48 @yahoo.com.hk 380,777 49 @yahoo.com.au 370,662 50 @hotmail.com.br 346,287 51 @verizon.net 341,630 52 @live.ca 318,949 53 @hotmail.com.ar 292,864 54 @excite.com 287,164 55 @laposte.net 280,167 56 @btinternet.com 279,092 57 @virgilio.it 269,784 58 @wanadoo.fr 268,126 59 @bellsouth.net 268,070 60 @email.com 265,114 61 @icloud.com 264,224 62 @yahoo.com.cn 261,927 63 @facebook.com 260,584 64 @cox.net 260,106 65 @windowslive.com 259,254 66 @tiscali.it 257,141 67 @live.nl 256,422 68 @free.fr 255,041 69 @freenet.de 254,195 70 @seznam.cz 249,557 71 @gmx.net 248,765 72 @o2.pl 232,689 73 @earthlink.net 229,113 74 @t-online.de 224,136 75 @yahoo.com.vn 215,779 76 @latinmail.com 212,064 77 @live.com.ar 210,307 78 @hotmail.ca 204,783 79 @live.com.au 201,867 80 @yahoo.co.jp 195,025 81 @me.com 194,905 82 @yahoo.gr 186,611 83 @gmx.at 181,420 84 @yahoo.com.sg 174,536 85 @live.cl 169,410 86 @netscape.net 167,281 87 @juno.com 164,607 88 @freemail.hu 162,510 89 @gmx.com 160,957 90 @charter.net 154,978 91 @live.de 152,999 92 @uol.com.br 152,498 93 @ovi.com 148,861 94 @live.com.pt 145,438 95 @voila.fr 144,744 96 @bigpond.com 144,575 97 @sapo.pt 141,379 98 @yahoo.com.ph 140,006 99 @terra.com.br 138,174 100 @inbox.lv 133,504

Languages What are the main languages (where available) spoken by FFN users?

Rank Language Frequency 1 english 248,986,884 2 spanish 63,602,761 3 portuguese 29,827,490 4 french 23,313,262 5 chinese 10,384,967 6 italian 8,730,620 7 german 8,308,691 8 dutch 3,870,729 9 tagalog 2,282,025 10 swedish 1,266,684 11 japanese 651,506 12 korean 281,388

Site Growth and Usage Sometimes when join dates and last visit dates are available, we can see how popular a website truly is.

AdultFriendFinder.com - Number of users who visited the site in this year, but never came back afterwards. The last number, 6 million in 2016 would represent the known total amount of users who visited the site in 2016.



Year Members who never returned after this year UNKNOWN 81,567,099 1997 36 1998 154 1999 10,166 2000 1,896 2001 93,127 2002 81,170 2003 826,403 2004 1,506,632 2005 699,309 2006 337,792 2007 2,542,016 2008 2,483,046 2009 11,449,232 2010 22,745,563 2011 39,986,839 2012 31,039,071 2013 53,186,359 2014 67,677,193 2015 17,487,269 2016 6,054,113 Cams.com - How many new people registered in each year? Year New Members 1998 103 1999 733 2000 636 2001 1,664 2002 8,288 2003 12,783 2004 17,067 2005 184,480 2006 828,922 2007 6,409,584 2008 8,853,411 2009 7,038,754 2010 7,097,596 2011 5,938,875 2012 6,896,421 2013 6,354,311 2014 5,588,085 2015 4,703,541 2016 2,700,272



We can also determine how many Cams.com users joined and never returned to the site (register date = last visit date). That number is 1,084,686 out of 62.6 million which is addmitedly quite impressive on their end, most of the users that come to the site actually use it.



Penthouse.com - How many new people registered in each year?

Data seems to end during the 2014 year, we're not sure why. Year New Members 1997 194 1998 1,325 1999 1,790 2000 349 2001 780 2002 1,926 2003 2,552 2004 5,330 2005 238,299 2006 142,855 2007 117,548 2008 1,248,557 2009 712,008 2010 1,315,626 2011 1,608,557 2012 1,113,536 2013 604,809 2014 60,708



Sometimes when join dates and last visit dates are available, we can see how popular a website truly is.The last number, 6 million in 2016 would represent the known total amount of users who visited the site in 2016.We can also determine how many Cams.com users joined and never returned to the site (register date = last visit date). That number is 1,084,686 out of 62.6 million which is addmitedly quite impressive on their end, most of the users that come to the site actually use it.Data seems to end during the 2014 year, we're not sure why.

Database Schemas Provided below are the table schemas for (in order), AdultFriendFinder.com, Cams.com, Penthouse.com. These are mostly of interest to IT professionals.















Provided below are the table schemas for (in order), AdultFriendFinder.com, Cams.com, Penthouse.com. These are mostly of interest to IT professionals.</s>A visitor takes pictures of an adult film actress during the Eros Show in the Bulgarian capital Sofia April 2, 2008. REUTERS/Stoyan Nenov (BULGARIA)

(Reuters) - Login credentials for over 412 million users of adult websites run by California-based FriendFinder Networks Inc. were compromised last month in the largest hack of 2016, according to breach notification website LeakedSource.com.

Compromised data includes nearly 340 million credentials for Adultfriendfinder.com, which bills itself as “the world’s largest sex and swinger community,” some 63 million records from video sex-chat site cams.com and about 7 million records from adult magazine site Penthouse.com, LeakedSource said in a blog published on Sunday.

Asked if the account from LeakedSource was accurate, the company provided Reuters with a statement saying it had brought in outside experts to help review the matter.

“FriendFinder takes the security of its customer information seriously and is in the process of notifying affected users to provide them with information and guidance on how they can protect themselves,” FriendFinder said in the statement.

“Our investigation is ongoing but we will continue to ensure all potential and substantiated reports of vulnerabilities are reviewed and if validated, remediated as quickly as possible,” it said.

If LeakedSource’s claims are confirmed, the number of email addresses would account for more than 10 times the number exposed in last year’s high-profile hack of infidelity website Ashley Madison. That attack prompted class action lawsuits and an investigation by the U.S. Federal Trade Commission.

LeakedSource said it was able to view passwords for 99 percent of the credentials.

It said that some 78,301 of the accounts were registered to .mil email addresses, which are used by the U.S. military, and another 5,650 were .gov addresses used by U.S. government agencies.</s>Adult FriendFinder, a dating website that got hacked last year, is investigating claims that millions of customers have had their personal information exposed in a second hack.

The potential damage could affect 412 million accounts because the company, Friend Finder Networks, has so many different operations.

It runs the popular swinger and alternative dating website AdultFriendFinder.com. It operates the sex chatting services Cams.com, iCams.com, and Stripshow.com. And it previously ran the porn site Penthouse.com.

A group of independent security researchers, who call themselves LeakedSource, said the hack includes 15 million people who thought they had deleted their accounts.

In a statement, the company said it has hired outside investigators to make sure website flaws "are reviewed and if validated, remediated as quickly as possible."

The company also stated that it "is in the process of notifying affected users... how they can protect themselves."

Related: Russian man accused of hacking U.S. targets arrested in Prague

CNNMoney has received samples of the stolen data from cybersecurity professionals and the hacker who has claimed responsibility. CNNMoney sent those samples to Friend Finder Networks, but the company has not yet confirmed they are legitimate.

A hacker, who goes by the name 1x0123, posted images last month purporting to prove the hack occurred on September 7.

The hacker told CNNMoney the user data is now being sold online for $4,000. "Everything is for sale these days, and I'm hungry," the hacker said.

David Kennedy, CEO of cybersecurity firm TrustedSec, said the stolen database is being offered for sale on several black market websites.

If confirmed, this would be the second embarrassing episode for the company. Last year, a hack exposed the sexual secrets of 3.5 million Adult FriendFinder users. That time, the company scrambled to calm down users who were worried that their listed sexual preferences would go public.

It would also be yet another lesson that online dating websites can't guarantee privacy and anonymity. When hackers exposed the users of cheating website Ashley Madison last year, the information quickly ended up in searchable databases identifying the cheaters.</s>Compromised data includes nearly 340 million credentials for Adultfriendfinder.com, which bills itself as "the world's largest sex and swinger community," some 63 million records from video sex-chat site cams.com and about 7 million records from adult magazine site Penthouse.com, LeakedSource said in a blog published on Sunday.

Asked if the account from LeakedSource was accurate, the company provided Reuters with a statement saying it had brought in outside experts to help review the matter.

"FriendFinder takes the security of its customer information seriously and is in the process of notifying affected users to provide them with information and guidance on how they can protect themselves," FriendFinder said in the statement.

"Our investigation is ongoing but we will continue to ensure all potential and substantiated reports of vulnerabilities are reviewed and if validated, remediated as quickly as possible," it said.

If LeakedSource's claims are confirmed, the number of email addresses would account for more than 10 times the number exposed in last year's high-profile hack of infidelity website Ashley Madison. That attack prompted class action lawsuits and an investigation by the U.S. Federal Trade Commission.

LeakedSource said it was able to view passwords for 99 percent of the credentials.

It said that some 78,301 of the accounts were registered to .mil email addresses, which are used by the U.S. military, and another 5,650 were .gov addresses used by U.S. government agencies.</s>WASHINGTON (dpa-AFX) - Account details of more than 400 million users of Adult FriendFinder site has been stolen, the second time this year that the adult-themed website has been hacked.



The email addresses and passwords of 412 million accounts have been leaked after Adult Friend Finder and its sister sites were hacked.



Adult Friend Finder touts itself as 'one of the world's largest sex hook-up' websites and boasts of more than 40 million active users. The hackers also stole data from its sister sites Cams.com and Penthouse.com, which is owned by parent company Friend Finder Networks.



It is not clear who is behind the breach of Friend Finder Networks. According to LeakedSource, which obtained the data and reported the breach first, the hack occurred in October.



Copyright RTT News/dpa-AFX</s>Hackers have stolen the details of more than eight million British accounts belonging to the world’s most popular adult dating and swingers site.

Over 412million members of the Friend Finder Networks are victims of the largest ever data breach , according to monitoring firm LeakedSource.

The hack exposed members’ email addresses, passwords, dates of last visits, browser information, IP addresses and site membership status.

The American-owned Friend Finder Networks operates ‘one of the world’s largest sex hookup’ sites Adult Friend Finder.
• AdultFriendFinder hack: Personal details of over 300 MILLION love rats exposed as smutty dating site gets hacked

It has ‘over 40 million members’ and over 339 million accounts.

Its British site boasts: “With so many sexy members looking for sex with adult friends, AdultFriendfinder.co.uk is the place to find adult no strings fun.

“Hook up easily tonight if you’re looking for an adult friend, swinging partner or just a casual sex date.

“Search our member database for adult friends, swingers, one night stands, casual sex, adult chat, and local sex and you’ll find lots of potential partners looking to get off with no strings attached.

“Adult FriendFinder has helped millions of people find traditional partners, swinger groups, threesomes, and a variety of other alternative partners.”

Although passwords were encrypted, hacking site LeakedSource managed to crack 99% of them as they were insecure.

One UK member, a father-of-two from Goole, East Yorkshire, told how he now fears his details will be among those now available.

The 37-year-old said: “I joined after I separated from my wife.

“I was going through a tough time and thought it would be an easy way to fulfil my needs without having to commit.

“I didn’t actually meet anyone through it but I did fill out the questionnaire in full.

“It’s worrying to think that information is now available to others now.”

Members, who pay up to £15 per month for gold membership, can detail their highly personal sexual preferences.

It is estimated of the 8.6 million UK accounts, three million are still active.

The company, based in Baco Raton, Florida, also runs live sex camera site Cams.com, which has over 62 million accounts.

It also runs, adult site Penthouse.com, which has over seven million accounts, as well as stripshow.com and iCams.com.

Vice president and senior counsel, Diana Ballou, said: “FriendFinder has received a number of reports regarding potential security vulnerabilities from a variety of sources.

“While a number of these claims proved to be false extortion attempts, we did identify and fix a vulnerability that was related to the ability to access source code through an injection vulnerability.”

Ballou said Friend Finder Networks brought in outside help to investigate the hack and would update customers as the probe continued.

However, she would not confirm the data breach.

The breach, the second in two years, is the biggest since the 2013 leak of 359 million MySpace users’ details.

Last year 3.9 million Adult FriendFinder members had their details leaked, including those who told the site to delete their accounts.

Of those 26,939 were found to have UK email addresses with a ratio of one woman to every 16 men.

The breach also comes 17 months after hackers threatened to expose the 1.2 m Brits who belonged to extra marital affair website Ashley Madison.

And it's not the first time

Hackers previously threatened to expose the secrets of 1.2 million Brits who belonged to extramarital affair website Ashley Madison .

They said they would release the information if the company refused to shut the site down.

The dating network, which ‘guarantees’ people seeking to cheat on their spouses they will ‘find someone’ was breached in July last year.

A group calling itself The Impact Team issued an ultimatum to Canadian owner Avid Life Media (ALM).

The group said that unless they took Ashley Madison down its 37 million users’ most intimate details would be published.

These included names, ages, addresses, credit card information and even sexual fantasies.

British victims were later targeted by blackmailers threatening to reveal all to their unsuspecting partners unless they were paid.

In America, two men took their lives after their information was made public.

The owners improved security, allowing the site to continue trading.
• The last login date included in the stolen files is October 17, 2016.
• An analysis of the most used passwords reveals that over 2.5 million users employed a simple password in the form of “12345” and variations. More than 86,000 used qwerty.</s>The personal details of hundreds of millions of users of adult meet-up websites have been exposed following the hacking of AdultFriendFinder and related sites.

The total of 412 million accounts includes 5.2 million UK email addresses, as well as associated information which could prove useful such as purchasing data.

The security breach occurred in October at the site’s parent company, California-based Friend Finder Networks. Other sites which may have ben affected include Cams.com, Penthouse.com, Stripshow.com and iCams.com.

The total includes information from 15 million accounts which had been deleted by users but which remained on the company’s servers and could stretch back as far as 20 years.

The latest leaking of personal data is a reminder of how vulnerable websites can be to attack, emphasised by the revelation that close to a million of the users whose data was compromised had used ‘123456’ as their password, with similar numerical combinations as well as ‘password’ and ‘qwerty’ also in the top 10.

ActionFraud - the UK’s national fraud and cyber crime reporting centre - offered the following advice:

If you use the same password for AdultFriendFinder.com anywhere else on the internet, then change it immediately. Use three words which mean something to you but are random to others - this creates a password that is strong and more memorable.

The data taken in the breach includes email addresses and usernames, which could be used in future for phishing attempts. If you receive unsolicited emails never reply with personal details and don’t click on any links as you could end up downloading malware.

Be wary of anyone calling asking for personal information, bank details or passwords. If in doubt, just hang up.</s>Friend Finder Networks, which owns a number of popular adult dating and pornography sites, has suffered one of the largest data breaches ever recorded, with 412 million of its accounts hacked, according to monitoring firm Leaked Source.

The leak reportedly took place in October and included email addresses, passwords, IP addresses and site membership status from customers using the Friend Finder Networks, which owns Penthouse.com, live sex camera site Cams.com and AdultFriendFinder — which is marketed as “one of the world’s largest sex hookup” sites, with about 339 million accounts.

According to Leaked Source, 78,301 of the hacked emails were from U.S. military addresses, 5,650 from government addresses and over 96 million addresses were Hotmail accounts.

Some of the most popular passwords included “123456,” “password” and “iloveyou.”

David Kennerley, director of threat research at Webroot, criticized the network for not taking proper precautions after a similar data breach just over a year ago.

“It’s clear that the organization has failed to learn from its past mistakes and the result is 412 million victims that will be prime targets for blackmail, phishing attacks and other cyber fraud.”

To get a sense of the size of the data leak, the much-publicized hack of adultery site Ashley Madison in 2015 affected 33 million user accounts.

Only Yahoo suffered a worse breach, with hackers compromising 500 million accounts back in 2014.
Breach notification website LeakedSource.com reports information for over 412 million users of FriendFinder Networks Inc. adult websites, as well as records from Penthouse.com, were compromised last month in the largest hack of the year. This attack potentially exposes 10 times the number in 2015's hack of infidelity website Ashley Madison.