Fling Data Breach (2011)
Online dating platform focused on casual relationships.
What this rating measures
The Index rates how dangerous a breach is right now rather than how large it was. It values each exposed field on its own, ages each one according to what that field is, and models what the assembled set lets an attacker do.
It is read against what is observed circulating, not what was announced. Five bands run from Low through Guarded, Elevated and High to Severe.
Every rating carries a status. Observed means it rests on fields seen circulating. Observed minimum means at least that much was seen, so read it as a floor. Provisional means the field list comes from breach catalogues and is not yet verified. How sure we are of the evidence is shown separately, and it never lowers the rating. How the Index works →
Includes data whose disclosure is itself the harm, such as sexual orientation or intimate preferences. It cannot be taken back, and it is used for extortion and outing.
- Volume
- Count not yet verified
- Field types
- 11 listed
- Breach date
- Mar 2011
14 years laterBreach- Listed in breach catalogues
What data was exposed
How this data can be used against you
Assessed once the record is scored.
Three key actions to take
Change your Fling password
Change it anywhere you reused it too, and turn on two-step sign-in.
Lock your mobile number
Ask your carrier for a port-out PIN so no one can move your number to a new phone.
Treat messages about Fling with care
Do not act on a call, email or text about this breach. Contact Fling using a number you already have.
Check whether you were affected
Most people in a breach like this do not need an engagement. They need to know whether their address is in it, and when it turns up somewhere new. HackNotice does both, free: an Instant Check now, alerts after.
Runs on HackNotice · ObscureIQ never sees the address you checkTalk to us about your exposure
If you are exposed in a way that cannot be rotated away, or you are responsible for someone who is, a call establishes what is actually reachable about you and what is worth doing first. No charge for the conversation.
Request a confidential call →The full breach analysis
What happened, what the company reported against what is circulating, the field-by-field record, the actor and the advisory.
- What happened
- Recent developments
- Reported and circulating
- Data points exposed
- Downstream risk
- Principal risk advisory
- Threat actor
- Background
- Data context
How this breach happened
Fling, an adult-oriented hookup and casual dating platform, was breached by an unknown attacker in 2011, exposing over 40 million user accounts. The method of intrusion has not been publicly disclosed. The breach did not surface widely until years after the incident, following a pattern common among early-2010s credential databases that circulated privately before becoming broadly known. The exposed data is unusually sensitive. Records included email addresses, passwords stored in plain text, dates of birth, phone numbers, geographic locations, IP addresses, genders, usernames, website activity histories, sexual orientations, and sexual fetishes. The combination of explicit sexual profile data with a hookup platform context creates serious risk of extortion, outing, and targeted harassment. Affected individuals may never have expected this information to leave the platform, and many may not know it was exposed at all. No settlement or regulatory action specific to this breach has been publicly documented. Affected users face lasting exposure: plain-text passwords can enable account takeovers across other services if reused, and the sexual profile data can be used to coerce or embarrass individuals years after the breach occurred. Anyone who used Fling around or before 2011 should treat their credentials as compromised and consider the possibility that their sexual identity information is in circulation.
What has happened since the breach
Fling has maintained a low public profile with no major organizational changes or ownership announcements prominently documented in recent years. The platform continues to operate as a niche adult dating service.
What was reported vs. what is circulating
Reported
- Status
- Not yet researched
Listed in breach catalogues
- Breach date
- Mar 2011
- Volume
- Count not yet verified
- Fields listed
- 11activity history (website activity), date of birth, email address, gender, geographic location, IP address, password, phone number, sexual orientation, sexual preferences, username
The score is built only on what is listed in circulation.
Every exposed field, and how long it stays useful
| Field | Shelf life | In notice | Listed |
|---|---|---|---|
| Activity History (website activity) | Lasts for years | No | Yes |
| Date of Birth | Lasts for years | No | Yes |
| Email Address | Lasts for years | No | Yes |
| Gender | Fades over a few years | No | Yes |
| Geographic location | Lasts for years | No | Yes |
| IP Address | Expires fast | No | Yes |
| Password | Expires fast | No | Yes |
| Phone Number | Fades over a few years | No | Yes |
| Sexual Orientation | Lasts for years | No | Yes |
| Sexual Preferences | Lasts for years | No | Yes |
| Username | Lasts for years | No | Yes |
Shelf life is how long a field stays useful to someone holding it. A password expires fast. A government ID number or a date of birth lasts for years. An address stays useful long after it stops being current.
How attackers can use this data
Very high sensitivity. Exposure enables extortion, reputational harm, harassment, and identity linkage around adult dating behavior and sexual interests.
Risks for executives and other high-profile people
An intimate-data breach: preferences, orientation or explicit content linked to an identity create acute coercion and blackmail exposure. For a high-profile principal this is targeting-grade, not merely identity-theft-grade: the combination lets an adversary locate, impersonate, or pressure the principal with little additional work.
Who is behind this breach
No threat actor has been publicly attributed.
About the company
Fling is an adult-oriented social network and casual dating platform marketed around hookup and short-term relationship facilitation. The platform has operated for many years as a smaller competitor in the adult dating market alongside services like Adult FriendFinder. It collects detailed personal and sexual profile information as part of its user registration and matching process.
Why the company holds this data
Adult-oriented dating platforms collect highly sensitive profile data, emails, messages, sexual-interest signals, photos, and account activity tied to casual or explicit relationship seeking.
About this record
No reported total is on record for this breach. No count has been verified for this breach yet. Figures in older breach catalogues are not shown until they are checked against the data. No score is shown until the circulating field list has been audited. Scores come from the Breach Risk Index, which rates what the exposed fields still let an attacker do, not how large the breach was. Breach records change as evidence does. If you hold a notice, a filing or a dataset observation this page does not reflect, report a correction.