Eroticy 2015 Data Breach
Platform · Adult dating and escort services · Account-based adult social and classifieds platform · Global
Eroticy Adult Dating & Escort Platform Breach (2015): 1.4 Million User Records Including Payment History, Home Address & Passwords Exposed
Eroticy was an adult-oriented platform combining dating, escort listings, and user profiles. The service enabled users to create accounts, browse listings, and interact with others for casual or transactional encounters. The model blends social networking with classifieds-style adult services, creating strong linkage between identity and real-world activity. /// Exposed data includes Password, Email;Email, IP addresses, Names, Passwords, Payment histories, Phone numbers, Physical addresses, Usernames, Website activity. High sensitivity. Elevated risk of extortion, reputational damage, and identity linkage.
Confirmed · ObscureIQ Intelligence
Breach Risk Index i
65/100
Lower riskHigher risk
High and current: recent, valuable data circulating on the dark web now.
Data Sensitivity i
RestrictedBeing associated with this breach can itself be harmful. Disclosure is limited and presence is not confirmed to unverified parties.
1.6MRecords
2015Year
The Breach Risk Index (BRI) is a proprietary 0–100 score rating how dangerous a breach is right now, based on how recently the data has been circulating on the dark web and how valuable it is to attackers.
Crucial data exposed
AddressPhysical address
Breach Summary
A data breach affecting an adult dating and escort-style platform, attributed in initial reporting to a site known as Eroticy, surfaced in late 2016 when a 120-megabyte SQL dump file labeled 'Eroticy.com_June_2015.sql.zip' began circulating among breach researchers. The data was distributed to Have I Been Pwned, which loaded the breach as a sensitive entry under the Eroticy name with explicit unverified flags. Have I Been Pwned founder Troy Hunt published a detailed verification account, noting that while many subscribers confirmed individual records as accurate to them, the actual source of the breach could not be conclusively attributed to Eroticy. The platform itself has not publicly acknowledged or disputed the attribution. The breach affected approximately 1.4 million to 1.6 million unique user accounts based on records indexed by breach-tracking services. Compromised fields included names, usernames, email addresses, phone numbers, physical addresses, IP addresses, passwords stored in plaintext for some records, payment histories including transaction records, and detailed website activity logs. The combination of plaintext passwords with payment history and home address from an adult-dating and escort-services context represents one of the most sensitive field combinations recorded in the historical adult-platform breach record. For affected users, the practical risk profile is exceptionally severe because of the combination of identity-fraud exposure with adult-platform-specific reputational risk. The combination of name, address, phone number, and plaintext password supports both credential-stuffing attacks against other accounts and synthetic-identity-fraud risk. More distinctively, inclusion in the dataset confirms an adult-dating or escort-services relationship and may reference real payment transactions for adult services. This creates substantial extortion risk, in which attackers threaten disclosure to family members, employers, or social networks unless ransom is paid. Affected users who receive extortion attempts should not pay ransom demands because payment does not stop further extortion and often invites additional attempts. Users should change any reused passwords immediately, enable two-factor authentication where available, document all extortion communications, and report extortion attempts to law enforcement. Affected users should also be aware that the source of this breach remains unconfirmed, meaning the data may have originated from a different platform than the one named in the breach record.
Full threat analysis, exploitation vectors, and principal guidance below.
10 additional sections · verified field analysis · defensive doctrine
Querying breach corpus…
Cross-referencing exposed field types…
Resolving threat-actor attribution…
Compiling principal risk advisory…
1.6M records analyzed
About Eroticy
Eroticy was reportedly an adult dating and escort-style social platform that combined dating profiles, escort listings, and user accounts to facilitate discreet adult encounters. The platform operated as an account-based service blending social networking with classifieds-style adult services, with users creating profiles, browsing listings, and arranging interactions for casual or transactional encounters. As an adult dating platform, Eroticy maintained substantial user account data including names, usernames, email addresses, phone numbers, physical addresses, IP addresses, passwords, payment histories, and records of user activity tied to intimate-services arrangements.
Why They Hold Your Data
Adult dating and escort-style platforms collect highly sensitive profile data, emails, usernames, relationship or sexual-interest signals, messages, and account activity tied to intimate services.
Recent Developments
The Eroticy breach is unusual within the historical adult-platform breach record because the source of the breach has not been definitively confirmed. Have I Been Pwned founder Troy Hunt published a detailed account of his verification process in late 2016, noting that while many HIBP subscribers confirmed individual records as accurate, the actual source of the data could not be conclusively attributed to Eroticy. The data was loaded into HIBP under the Eroticy name with explicit 'unverified' flags and accompanying explanation. As of current reporting, no entity has formally claimed the dataset or accepted responsibility for the breach, and Eroticy itself has not publicly acknowledged or disputed the attribution.
Data Points Exposed
9 verified field types
Activity History
Email Address
Full Name
IP Address
Password High
Phone Number
Physical address High
Transaction History
Username
Breach Impact
The institutional impact on Eroticy as an entity has been limited given the unconfirmed source attribution and the platform's apparent disappearance from active operation. No public regulatory action, civil litigation, or formal acknowledgment has been documented. The case has been cited in security research as a leading example of breach attribution challenges and the difficulty of confirming the original source when data circulates through hacker forums and third-party aggregators. The institutional impact has fallen primarily on the affected individuals, who must respond to a breach without a confirmed responsible party.
Exploitation & Downstream Threats
• Credential stuffing against reused passwords across other platforms | • SIM swap attacks where phone numbers are present | • Targeted phishing campaigns using exposed email addresses | • Doxxing risk from physical address exposure
Principal Risk Advisory
What this means for a principal
An intimate-data breach: preferences, orientation or explicit content linked to an identity create acute coercion and blackmail exposure. For a high-profile principal this is targeting-grade, not merely identity-theft-grade: the combination lets an adversary locate, impersonate, or pressure the principal with little additional work.
What You Should Do
- Treat the home address as exposed: review mail and package handling and physical-security routines, and brief household staff to verify unusual requests.
- Reset any reused passwords and enable MFA on email first, then financial accounts.
- Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
- Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.
How ObscureIQ Can Help
- Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
- Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
- ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).
Protect Yourself
Protect Yourself: Limited Disclosure
Check If You’re Affected: Verification Required
Because being associated with this breach can itself be harmful, we do not confirm whether anyone appears in it to unverified parties. Verify your identity to privately check whether your own data appears in this breach or related indexes.
We will only reveal whether a specific person appears in this breach to that person.
Get Free Breach Alerts
Be the first to know when new breaches are disclosed. Free forever — confirm your email with a 6-digit code.
High-Risk? Get an Exposure Audit
Executives, public figures, and high-visibility operators can receive tailored exposure intelligence and hardening guidance.
Request Consultation