An intrusion at online dating service
Cupid Media
earlier this year exposed more than 42 million consumer records,
including names, email addresses, unencrypted passwords and birthdays,
according to information obtained by KrebsOnSecurity.
The data stolen from Southport, Australia-based niche dating service
Cupid Media was found on the same server where hackers had amassed tens
of millions of records stolen from
Adobe,
PR Newswire and the
National White Collar Crime Center (NW3C), among others.
The purloined database contains more than 42 million entries in the
format shown in the redacted image below. I reached out to Cupid Media
on Nov. 8. Six days later, I heard back from
Andrew Bolton, the company’s managing director. Bolton said the information appears to be related to a breach that occurred in January 2013.
“In January we detected suspicious activity on our network and based
upon the information that we had available at the time, we took what we
believed to be appropriate actions to notify affected customers and
reset passwords for a particular group of user accounts,” Bolton said.
“We are currently in the process of double-checking that all affected
accounts have had their passwords reset and have received an email
notification.”
A redacted screen shot showing several of the stolen user accounts. Passwords were stored in plain text.
I couldn’t find any public record — in the media or elsewhere — about
this January 2013 breach. When I told Bolton that all of the Cupid
Media users I’d reached confirmed their
plain text passwords as
listed in the purloined directory, he suggested I might have “illegally
accessed” some of the company’s member accounts. He also noted that “a
large portion of the records located in the affected table related to
old, inactive or deleted accounts.”
“The number of active members affected by this event is considerably
less than the 42 million that you have previously quoted,” Bolton said.
The company’s
Web site and
Twitter feed
state that Cupid Media has more than 30 million customers around the
globe. Unfortunately, many companies have a habit of storing data on
customers who are no longer active.
Alex Holden, chief information security officer at
Hold Security LLC, said Bolton’s statement is reminiscent of the stance that software giant
Adobe Systems Inc. took
in the wake of its recently-disclosed breach.
In that case, a database containing the email and password information
on more than 150 million people was stolen and leaked online, but Adobe
says it has so far only found it necessary to alert the 38 million
active users in the leaked database.
“Adobe said they have 38 million users and they lost information on
150 million,” Holden said. “It comes to down to the definition of users
versus individuals who entrusted their data to a service.”
31
million Cupid users registered with a Yahoo, Hotmail or Gmail address.
56 Homeland Security Dept. employees were looking for love here as well.
The danger with such a large breach is that far too many people reuse
the same passwords at multiple sites, meaning a compromise like this
can give thieves instant access to tens of thousands of email inboxes
and other sensitive sites tied to a user’s email address. Indeed,
Facebook has been mining the leaked Adobe data
for information about any of its own users who might have reused their
Adobe password and inadvertently exposed their Facebook accounts to
hijacking as a result of the breach.
Holden added that this database would be a gold mine for spammers,
noting that Cupid’s customers are probably more primed than most to be
responsive to the types of products typically advertised in spam (think
male enhancement pills, dating services and diet pills).
Bolton adopted a softer tone in the second half of his email,
indicating that the company may not have understood the full scope of
the intrusion.
“Since you have now provided additional information we now have a
clearer picture of what transpired back in January,” Bolton wrote. “We
are currently in the process of double-checking that all affected
accounts have had their passwords reset and have received an email
notification.”
Bolton continued:
Subsequently to the events of January we hired external
consultants and implemented a range of security improvements which
include hashing and salting of our passwords. We have also implemented
the need for consumers to use stronger passwords and made various other
improvements.
We would like to thank you for bringing this issue to our attention
and I can confirm that we are committed to investigate this matter
further and make any additional improvements still required. Protecting
our customer’s privacy and data is important to us and we will continue
to make additional investments in improved security for our members. We
sincerely apologize for the inconvenience this has caused our members.
It is entirely likely that the records I have seen are from the
January breach, and that the company no longer stores its users’
information and passwords in plain text. At least Cupid Media doesn’t
send your password in plain text when you request a password reset,
like far too many other companies do.
It’s also remarkable that a company with this many users would not have
seen this coming. Back in Feb. 2011, I broke a story that received
considerable media attention; it was about a hack that
exposed some 30 million customer records at Plenty Of Fish (pof.com), an online dating service that also admitted to storing its users’ passwords in plaintext.
In any case, since I didn’t have to crack any of the passwords, I
thought it might be useful to have a look at the top passwords used by
Cupid Media customers. It seems that many Cupid users did not place much
value in their accounts when picking passwords, because a huge
percentage of them chose downright awful passwords. By my count, more
than 10 percent of Cupid’s users chose one of these 10 passwords:
The top 10 non-numeric passwords are probably typical for a dating site, but still horrible nonetheless:
