Shadi.com Muslim Matrimonial Platform Breach (2016): 2 Million User Accounts Including Plaintext Passwords Exposed

About Shadi.com

Shadi.com is a web-based Muslim marriage-introduction service that connects men and women in the UK, United States, Canada, and other countries who are seeking marriage. It operates in the matrimonial/matchmaking category rather than casual dating, and historically positioned itself around protecting member contact information to prevent unwanted communication. It should not be confused with Shaadi.com, the larger India-based People Group matrimonial platform; the two are unrelated entities that share a similar name. As a matchmaking service, Shadi.com collects email addresses, account credentials, profile details, and relationship-intent information tied to a religiously identifiable user base.

Why They Hold Your Data

Matrimonial platforms collect highly sensitive profile data, family details, religion or caste-related attributes, photos, messages, and relationship-intent records tied to matchmaking workflows.

Recent Developments

No significant public developments have been reported for Shadi.com since the 2016 breach; the service has maintained a low public profile and issued no substantial breach communications of record. The breach data continued to circulate through breach-aggregation and credential-search services (Have I Been Pwned, LeakedSource, and numerous mirror catalogues) in the years following disclosure, and HIBP added the dataset to its index in July 2022, flagging it as sensitive and not publicly searchable. Because the exposed credentials were stored in plaintext, the data remains directly usable for credential stuffing wherever affected members reused passwords, keeping the record operationally relevant nearly a decade later.

Data Points Exposed

Breach Impact

Plaintext-equivalent passwords enable immediate account access and stuffing; association with a religious matrimonial site adds sensitivity (inferred religion/relationship status).

Exploitation & Downstream Threats

• Credential stuffing against reused passwords across other platforms | • Targeted phishing campaigns using exposed email addresses

What You Should Do

1. Reset any reused passwords and enable MFA on email first, then financial accounts.
2. Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.

How ObscureIQ Can Help

1. Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
2. Exposure mapping: cross-reference the exposed identifiers against broker-available data to size and prioritize the principal's wider footprint.
3. ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).