Adult FriendFinder data breach: how to check and what to do
Adult FriendFinder (AFF) was breached twice, in 2015 and 2016. The 2016 breach was one of the largest ever recorded. If you've ever had an AFF account, you can check privately whether your email was included. If you get a threatening email that quotes an old password, it's almost certainly a scam.
How we wrote this. Breach details come from the breach-notification service Have I Been Pwned (HIBP) and contemporary reporting by BleepingComputer. Extortion-scam guidance comes from FBI Internet Crime Complaint Center (IC3) public service announcements. Everything was checked on October 17, 2026. This page has no affiliate links.
What was exposed
| 2015 breach | 2016 breach | |
|---|---|---|
| When | May 2015 | October 2016 |
| Size | About 3.9 million records (HIBP: 3,867,997) | About 412 million accounts across FriendFinder Networks sites, about 340 million of them from AFF (BleepingComputer). HIBP holds 170 million unique email addresses from it |
| Data | Email addresses, usernames, dates of birth, gender, location, IP addresses, relationship status, sexual orientation and more | Email addresses, usernames and passwords (many stored in plain text or weakly hashed, per reporting), plus language preferences |
| Card data | FriendFinder Networks said no payment card data was taken in 2016 | |
BleepingComputer also reported that the 2016 data included millions of accounts marked as deleted, so closing an account then didn't necessarily remove it from the database.
How to check whether your email was included
HIBP classes both AFF breaches as "sensitive". That means they don't show up in a normal public search, to protect members from being looked up by others. To see them:
- Go to haveibeenpwned.com and sign in to its dashboard with the email address you used for AFF.
- HIBP sends a verification email to that address. You can only check an address you can still receive email at.
- Once signed in, look under Breaches in the Personal section. Sensitive breaches appear there.
A quick search of your email on the HIBP home page won't show AFF results even if you were in the breach, so don't take a clean result there as an all-clear.
If you were affected
- Change any password you reused. If you used your old AFF password anywhere else, change it there first, starting with email and banking.
- Turn on two-factor authentication for your main email account.
- Use a password manager so every site gets a unique password.
- Consider a separate email for adult sites from now on. Our privacy guide explains a safe setup.
- Close or update the account if you still have one. See how to cancel and delete AFF.
Extortion emails that quote your password
Since these breaches, the FBI's IC3 has warned about extortion emails that use details from breached data to look convincing. According to IC3, they typically:
- come from someone you don't know and open with your username or an old password;
- accuse you of visiting adult sites or cheating;
- claim malware recorded you, or that they have "a video";
- threaten to send it to family, friends or coworkers; and
- demand payment in Bitcoin, usually within 48 hours.
An old password in the email shows the sender has breach data, not that they've hacked your device or have any recording. IC3's advice is not to communicate with the sender. Don't reply and don't pay, and report it at ic3.gov. Then change that password anywhere you still use it.
If someone is threatening to share real intimate images, that's different and serious. See our scam guide, the FBI's sextortion page and StopNCII.org.
Should this stop you using AFF?
That's your call. The breaches were years ago, but they show why it's sensible to give any adult site as little real information as possible: a separate email, a unique password, no face photos you couldn't live with leaking, and no reused usernames. For more on AFF today, see our Adult FriendFinder review.
Sources: Have I Been Pwned FAQs (sensitive breaches); Have I Been Pwned breach records "Adult FriendFinder (2015)" and "Adult FriendFinder (2016)"; BleepingComputer, November 14, 2016; FriendFinder Networks statement; IC3 PSA (2018); IC3 PSA (2016). Checked October 17, 2026.