In November 2016, outlets including TechCrunch and Dark Reading reported that data from the FriendFinder group's sites, covering about 412 million accounts, had been exposed, with weak password protection reported on some records. If you ever had an account, assume your email may be exposed, change reused passwords and watch for phishing and extortion attempts.
What was reported about the 2016 breach?
In mid-November 2016, security researchers and news outlets reported that a large database linked to the FriendFinder group of sites had been exposed. Coverage by outlets such as TechCrunch, Dark Reading, CSO and Bitdefender put the number at roughly 412 million accounts across several brands, including AdultFriendFinder.
These numbers come from press and researcher reports, not from this site, so treat them as reported figures. The details of how the data was obtained were described differently in different articles, and we do not repeat unverified claims.
What kind of data was said to be involved?
Reports described records containing email addresses, usernames and passwords, along with other account details such as dates of last visit. Several reports said that many passwords were protected with a weak method or not protected strongly, which would make them easier to crack.
Some coverage also said the records included accounts that people thought had been deleted. We cannot confirm that, so it is hedged here, but it is a good reminder that a deleted profile and deleted data are not always the same thing. A smaller incident was also reported in 2015.
Why does a dating-service breach matter more?
An ordinary retail breach might expose a shopping history. A breach at an adult dating service can expose a sensitive link between your email and a service where you shared personal preferences. That can lead to embarrassment, targeted phishing and extortion attempts, even if no private message was exposed.
Scammers know this. A common trick is an email claiming to have your password, often an old one from a breach, and demanding payment so that it stays private. Seeing a real old password in a message can feel frightening, but it only proves the data leaked, not that anyone has access to your devices.
Steps to take today
- Change the password on any account that ever used the same password as your AdultFriendFinder login.
- Use a password manager so every account has a unique, random password.
- Turn on two-step login on your email and bank accounts.
- Check your email address with a well-known breach-notification service, typing it only into that service.
- Be cautious with messages claiming to know a password. Do not pay, and do not reply.
Quick guide to scam messages after a breach
Use this simplified table to judge what you receive.
| Message type | What it says | What to do |
|---|---|---|
| Extortion email | Claims it holds your password or images | Do not pay, report it |
| Fake security alert | Asks you to log in via a link | Go to the service directly |
| Genuine notification | Advises a password change, no link demands | Verify independently first |
| Phone call | Claims to be fraud support | Hang up, call your bank |
How to lower the damage if you were affected
Start with the email address you used. If it is your main address, add extra protection and consider moving important accounts to a new one. Review your online accounts for anything linked to that address and update the passwords in order of importance: email first, then banking, then everything else.
Look at your credit and bank activity for unfamiliar items. Breach data is sometimes combined with other leaks to make convincing fraud attempts. If you receive threats, keep the messages, do not pay, and report them to your national cyber-crime service. In the US you can report to the FTC. In India you can use the national cyber-crime reporting portal.
What the breach teaches about future sign-ups
The practical lesson is the same for any sensitive service. Never use your main email, never reuse a password, and share only what the service genuinely needs. If you did this, a breach is an inconvenience. If you did not, it can follow you for years.
It also helps to know your data rights. Under GDPR in Europe and the UK, you may be able to ask what a company holds and request erasure. Several US states offer similar rights. These rights do not undo an old leak, but they can limit what a company keeps going forward. This is general information, not legal advice.
Finally, avoid panic. A reported breach from several years ago does not mean your device is compromised or that someone is watching. It means some account details may be out there. Calm, practical steps such as changing passwords, using an alias and ignoring threats will cover most of the risk. If you feel overwhelmed or frightened by a message, talk to a trusted person, since scammers depend on you acting in secret and under pressure.
Key takeaways
- A breach covering about 412 million accounts across the group's sites was widely reported in 2016.
- Weak password protection was reported on some records.
- Old password emails from scammers prove a leak, not a hack of your device.
- Change reused passwords and turn on two-step login for email and banking.
- Use an alias email and unique password for any future sensitive sign-up.
Frequently asked questions
This article is general information, not legal, financial or medical advice. Details about third-party services are based on public information and may change.