Mate1.com 2016 Data Breach
Platform · Online dating and matchmaking · General dating platform · Global
Mate1 Dating Platform Breach (2016): 27 Million User Profiles Including Sexual Preferences, Religion & Drug Use Habits Exposed
Online dating platform.
Confirmed · ObscureIQ Intelligence
Breach Risk Index i
65/100
Lower riskHigher risk
High and current: recent, valuable data circulating on the dark web now.
Data Sensitivity i
RestrictedBeing associated with this breach can itself be harmful. Disclosure is limited and presence is not confirmed to unverified parties.
27.4MRecords
2016Year
The Breach Risk Index (BRI) is a proprietary 0–100 score rating how dangerous a breach is right now, based on how recently the data has been circulating on the dark web and how valuable it is to attackers.
Crucial data exposed
IntimateSexual Preferences
Breach Summary
Mate1.com, an international online dating site that claimed approximately 36.5 million users globally, suffered a data breach in approximately February 2016 when an attacker compromised Mate1.com's MySQL database server through what the attacker described as shell or command access to the server. The attacker subsequently posted an advertisement on the dark-web forum Hell offering the stolen data for sale at approximately 20 Bitcoin (approximately $8,700 at the time), and the data was confirmed to have been sold to at least one buyer. The hacker stated that the original dump contained approximately 40 million accounts and was reduced to approximately 27 million after the hacker removed bot accounts identified by a common password pattern. Mate1.com did not initially acknowledge the breach, and Motherboard's verification process confirmed that 498 of 500 sampled email addresses corresponded to actual Mate1.com accounts. The breach affected approximately 27.4 million subscribers based on records indexed by Have I Been Pwned and DataBreach.com. Compromised fields included email addresses, names, usernames, dates of birth, gender, sexual fetishes, drug use habits, drinking habits, smoking habits, political views, religion, ethnicities, income levels, job titles, education levels, parenting plans, fitness levels, physical attributes, geographic locations, relationship statuses, personal descriptions, astrological signs, travel habits, work habits, website activity records, and passwords stored in plaintext. The plaintext password storage represents a critical security failure that exposes the original credential values directly to anyone with access to the dataset, with no cryptographic protection of any kind. Independent verification by Troy Hunt confirmed the plaintext-password storage by testing Mate1.com's password-reset feature, which emailed the user's actual plaintext password rather than triggering a reset. For affected users, the practical risk profile is among the most severe in the dating-platform breach corpus because of the unusually broad and sensitive field set combined with plaintext password exposure. The combination of name, email, date of birth, geographic location, job title, income level, and political and religious views creates substantial identity-fraud, employment-targeting, and discrimination risk. The exposure of sexual fetishes, drug use habits, and political views creates targeted harassment, doxxing, and extortion risk that varies significantly across user populations. Affected users may face employment, relationship, and family consequences depending on which fields are most sensitive in their personal context. The plaintext password exposure means that any account where the user reused the Mate1.com password is fully compromised. Affected users who receive extortion attempts should not pay ransom demands because payment does not stop further extortion. Users should change all reused passwords immediately, enable two-factor authentication where available, document any extortion communications, and report extortion attempts to law enforcement. Because Mate1.com did not require email verification at account creation, individuals who find their email address in the dataset but who do not recall ever creating a Mate1.com account may have had their email used by another party to create an account, which is itself a risk worth investigating.
Full threat analysis, exploitation vectors, and principal guidance below.
10 additional sections · verified field analysis · defensive doctrine
Querying breach corpus…
Cross-referencing exposed field types…
Resolving threat-actor attribution…
Compiling principal risk advisory…
27.4M records analyzed
About Mate1.com
Mate1.com was a large international online dating site that operated under the mate1.com domain and claimed approximately 36.5 million users globally at the time of the 2016 breach. The platform operated as a general-interest dating service with extensive profile-attribute matching that captured a substantially broader range of personal-attribute fields than mainstream dating platforms, including sexual fetishes, drug use habits, drinking habits, political views, religion, ethnicity, income levels, education levels, job titles, parenting plans, fitness levels, physical attributes, astrological signs, and travel and work habits. The platform did not require email verification at account creation, which meant that the user database included a substantial proportion of fake or unverified accounts in a pattern similar to that documented at Ashley Madison.
Why They Hold Your Data
Dating platforms collect profile data, photos, messages, account records, and subscription activity tied to online matchmaking workflows.
Recent Developments
Mate1.com initially did not acknowledge the breach when it was disclosed on the dark-web forum Hell in late February 2016, with no public statement appearing on Mate1.com's website at the time of the original Motherboard reporting. Independent verification by Have I Been Pwned founder Troy Hunt and security researchers documented that Mate1.com continued to store user passwords in plaintext for months after the breach, with the password-reset functionality returning the user's actual plaintext password by email rather than triggering a password-reset workflow. The case has been widely cited in dating-platform cybersecurity coverage as illustrating systemic data-protection failures at large general-interest dating services in the post-Ashley Madison period and as one of the leading examples of the persistent plaintext-password storage pattern in the dating-platform sector. The breach was redistributed and indexed by DataBreach.com on November 30, 2024.
Data Points Exposed
23 verified field types
Activity History
Astrological Sign
Date of Birth High
Education Information
Email Address
Ethnicity Or Race
Financial Profile
Full Name
Gender
Geographic location
Job Information
Lifestyle Habits
Parenting Preferences
Password High
Physical And Lifestyle Profile
Political Views
Profile Bio
Relationship Status
Religion
Sexual Preferences High
Travel Information
Username
Work Habits
Breach Impact
The institutional impact on Mate1.com has been moderate given the platform's apparent unresponsiveness to the original breach disclosure and the limited public regulatory or civil-litigation activity relative to the breach's scale. The lack of acknowledgment and the documented persistence of plaintext-password storage represent a notable departure from contemporary industry breach-response practices. Reputational impact concentrated within the broader dating-platform sector, where the breach has been frequently cited alongside Ashley Madison and AdultFriendFinder as illustrating the elevated risk profile of dating-service data exposure. The breach's redistribution and indexing in late 2024 has renewed attention to the case as part of the broader 2024 to 2025 dating-platform breach redistribution wave.
Exploitation & Downstream Threats
• Credential stuffing against reused passwords across other platforms | • Financial fraud using exposed financial profile data | • Identity verification bypass using name + date of birth combination | • Targeted phishing campaigns using exposed email addresses | • Doxxing risk from physical address exposure | • Employment-based social engineering using job and employer data
Principal Risk Advisory
What this means for a principal
An intimate-data breach: preferences, orientation or explicit content linked to an identity create acute coercion and blackmail exposure. For a high-profile principal this is targeting-grade, not merely identity-theft-grade: the combination lets an adversary locate, impersonate, or pressure the principal with little additional work.
What You Should Do
- Reset any reused passwords and enable MFA on email first, then financial accounts.
- Be alert to sextortion or blackmail attempts referencing this data and do not engage; preserve and report messages.
- Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.
How ObscureIQ Can Help
- Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
- Exposure mapping: cross-reference the exposed identifiers against broker-available data to size and prioritize the principal's wider footprint.
- ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).
Protect Yourself
Protect Yourself: Limited Disclosure
Check If You’re Affected: Verification Required
Because being associated with this breach can itself be harmful, we do not confirm whether anyone appears in it to unverified parties. Verify your identity to privately check whether your own data appears in this breach or related indexes.
We will only reveal whether a specific person appears in this breach to that person.
Get Free Breach Alerts
Be the first to know when new breaches are disclosed. Free forever — confirm your email with a 6-digit code.
High-Risk? Get an Exposure Audit
Executives, public figures, and high-visibility operators can receive tailored exposure intelligence and hardening guidance.
Request Consultation