A recent hack of one of the most heavily trafficked sites in the US – has lead to the public release of the sexual preferences of approximately 4 million users of the Adult Friend Finder site.–PC Pitstop
Hack Exposes Sexual Secrets of Millions
By Stu Sjouwerman, for KnowBe4.com Security Awareness Training
Adult Friend Finder Hack Is Nightmare Phishing Problem
Guys, we have a real phishing problem with this Adult Friend Finder (AFF) hack. This particular adult site is one of the most heavily-trafficked websites in the U.S. and has 40 million registered users. A rough guess is that 10% of your users may be very worried at this time that their sexual preferences and/or activities are going to come out. These end-users are a security breach waiting to happen.
You may have heard about it, but in short the story is that the AFF site owed $248,000 to someone, very likely an affiliate that was feeding them web traffic, and apparently AFF did not pay up. The affiliate had a hacker buddy who calls himself ROR[RG] and this guy decided to teach AFF a lesson.
He hacked them, exfiltrated at least 4 million records and then sent them a ransom demand of $100,000 to return the data. Again, apparently AFF did not pay up (again) and ROR[RG] in retaliation posted these records on a Darknet Tor site loaded with a ton of highly personal, sensitive information, including their age, sexual preferences, state, zip code, username, IP address, and if they are married or single, gay or straight, and are looking for a “cheating one night stand” or more let’s call it unorthodox sexual activities. With a little bit of digging, these people are relatively easy to find. Bev Robb, who does malware and dark Web research, wrote a blog post showing how easy it is.
FriendFinder Networks, a California-based company wrote that it had hired FireEye’s forensics unit, Mandiant, to investigate along with Holland and Knight, a law firm, and a public relations company specializing in cybersecurity.
“We cannot speculate further about this issue, but rest assured, we pledge to take the appropriate steps needed to protect our customers if they are affected,” it said. The company could not be reached for further comment. UK TV Channel 4 reported it first, and stated exposed email addresses are receiving a wave of spam. Here is their 4-minute segment.
