Fling.com Hack Exposes Passwords (And More) Of 40 Million Users
- Wednesday, June 22 2016 @ 06:52 am
- Contributed by: ElyseRomano
- Views: 5,972

Fresh off the news that BeautifulPeople.com had been hacked comes another tale of privacy violation. This time, Fling.com is the victim of the breach.
International Business Times reports that tens of millions of credentials were stolen from the adult dating website and put up for sale on the dark web. The information allegedly includes usernames, plain text passwords, email addresses, IP addresses, gender, sexual preferences, and date of birth records. It appears that some of the accounts belong to Fling administrators.
According to the hacker responsible for the breach - who goes by the pseudonym ‘peace_of_mind’ - the data dump contains more than 40 million Fling.com records. It’s currently on sale for 0.8874 bitcoins, which is worth approximately $411 at the time of writing.
Vice Motherboard obtained a sample of the data from the hacker. The individual to whom the Fling.com domain is registered then confirmed its legitimacy.
“We take internet security very seriously,” he wrote in an email to Motherboard. “Our site is free to join and we do not store any credit card information. We've investigated the sample data and it is from a breach that happened in 2011.”
Motherboard also shared the sample data with security researcher Troy Hunt, proprietor of the breach notification website “Have I Been Pwned?” Using HIBP, Hunt discovered and contacted two victims of the Fling breach. One confirmed their full password in the sample. The second claimed they had no recollection of joining the site, but said the beginning of the password was something they have used in the past.
On the bright side, some of the email addresses in the sample did not appear to belong to any Fling accounts. Motherboard tested 101 addresses and found that only 61 were already in use.
Additionally, some of the accounts included in the data may have been disabled prior to the breach. “Accounts in the sample were also flagged with settings such as ‘admin_disabled,’ ‘user_disabled,’ or “active,’” writes Motherboard. “However, these flags seemed to have no bearing on whether an email address was already in use or not on Fling.”
Continued investigation provided further reason to believe that not all the accounts for sale are valid. Motherboard found that accounts can be created on Fling without clicking a verification link sent to an email address. They also found that Fling passwords are required to include numbers, though many passwords in the sample data only contained letters.
To be on the safe side, anyone who has used Fling.com should change their password - particularly if it has been used for more valuable services, like an email account or bank account.




