← Cupid Media

2013 — Cupid Media: Jan 2013 (disclosed Nov 2013), 42.0M records

2013 42.0M records affected Share on X

Data compromised

Names, emails, DOB, passwords (plain text)

Technical writeup

Jan 2013 (disclosed Nov 2013). ColdFusion vulnerability exploited; attackers uploaded shell, ran SQL queries. Exposed: names, emails, DOB, passwords in plain text across 35 dating sites. Data found on same server as Adobe, PR Newswire breaches. Australia Privacy Commissioner found Cupid breached privacy law.

Root cause

Unpatched ColdFusion vulnerability; plaintext password storage.

References