AdultFriendFinder is a long-running legitimate service, but a large breach was widely reported in November 2016, affecting more than 400 million accounts across the group's sites. Treat older details as exposed, use a unique password and separate email, avoid sharing identifying information, and be wary of fake profiles and requests for money.
Why a company's breach record matters
When you join a dating service you hand over an email, a date of birth, photos and often payment details. How a company protects that information is one of the best indicators of whether it deserves your trust. No large online service is immune from attack, but what happens before and after an incident tells you a lot.
For AdultFriendFinder, the event most often cited is the breach reported in November 2016. This report explains it in plain terms, without drama and without excusing it.
What was reported in 2016
In mid-November 2016, several major technology outlets reported that data from the FriendFinder group's sites had been leaked. The headline figure was more than 412 million accounts, with roughly 339 million said to come from AdultFriendFinder itself. Other brands in the group, including live video services, were also named in reports.
Reports said the data included email addresses, usernames and passwords, and that some passwords had been stored in a weak way, in plain text or with an outdated method. Figures and details come from the reporting of the time and from researchers who analysed the data, so treat them as approximate. An earlier, smaller incident was also reported in 2015.
What the network structure means
The 2016 reports were notable because one incident reached several brands at once. When related services share technology, accounts or databases, a single weakness can affect all of them. That is a general point about networks, and it is why privacy advice for AFF includes your other accounts.
If you ever used the same email and password on more than one service, a leak at one can unlock the others. Change reused passwords, and use a different email for dating services than for banking or work.
What the trust record does and does not tell you
A breach does not mean a service is a scam, and a clean record does not mean a service is safe. It does mean you should plan for the worst case. Ask yourself what would happen if your profile details became public, and share only what you could live with.
| Question | What to look for |
|---|---|
| Do I use a unique password? | Yes, with a manager |
| Is my email separate? | Not linked to my name |
| Are my photos identifying? | Avoid face plus details |
| Joined before late 2016? | Treat data as exposed |
Other risks that matter more day to day
For most members, daily risk comes from people rather than databases. Fake or automated profiles, romance scams and sextortion are known patterns on dating services of every kind. Signs include fast declarations of affection, refusal to video chat, requests to move to a private app and any request for money.
Billing is the other practical risk. Plans usually renew automatically, so set a reminder and keep receipts. Lookalike sites that copy dating brand names exist, so always reach the service by typing its name into a search engine or app store, not by clicking a message.
Practical steps you can take today
- Change your password to a long, unique one.
- Turn on any extra login protection offered.
- Use a separate email that does not contain your name.
- Review what your profile shows publicly.
- Check your statement for charges you do not recognise.
- Do not click login links in unexpected emails.
If you are worried about an old account, you can ask the company about data access or deletion, and keep a record of your request.
If you receive threats or demands
If someone threatens to share private images or contact people you know, stop replying, do not pay, keep every message and report both the account and the incident. In the US, the FTC and national reporting centres take scam reports, and other countries have equivalents. You can also use the report link on this site for guidance. Asking a trusted friend for support helps, because these scams rely on shame and secrecy.
This guide is independent and not run by the service.
After any large incident, look for three signs of a healthy response: a clear public explanation, a prompt notice to affected users and visible security improvements afterwards. Public reporting after November 2016 covered the scale of the leak, but I could not verify the detail of every step the company took, so none is claimed here.
That uncertainty is itself useful information. When you cannot easily confirm how a company improved, rely on your own protection instead of trusting the brand to do it for you.
People often forget accounts they created years ago. An unused AFF profile may still hold an email, a username and old photos. If you no longer use the service, cancel any paid plan, ask about deletion and remove the profile content first. Then change the password on any other service that used the same one.
Key takeaways
- A breach affecting more than 400 million accounts across the group was widely reported in November 2016.
- Reports said some passwords were weakly protected, so treat older details as exposed.
- Shared systems across related sites can widen the impact of one incident.
- A unique password and a separate email are the most useful habits.
- Never send money and never pay anyone who threatens to share images.
Frequently asked questions
This article is general information, not legal, financial or medical advice. Details about third-party services are based on public information and may change.