• Skip to main content
  • Skip to primary sidebar
  • Skip to footer
  • Home
  • About Darknet
  • Hacking Tools
  • Popular Posts
  • Darknet Archives
  • Contact Darknet
    • Advertise
    • Submit a Tool
Darknet – Hacking Tools, Hacker News & Cyber Security

Darknet - Hacking Tools, Hacker News & Cyber Security

Darknet is your best source for the latest hacking tools, hacker news, cyber security best practices, ethical hacking & pen-testing.

BeautifulPeople.com Leak Exposes 1.1M Extremely Private Records

April 28, 2016

Views: 5,045

So another data breach, and no surprise here, but another dating site. This time the BeautifulPeople.com Leak has exposed 1.1 million customer records, including 15 million private messages sent between users.

Not so private now is it.

BeautifulPeople.com Leak Exposes 1.1M Extremely Private Records

And no surprise either the entry point for this leak, was the not-so excellent NoSQL database MongoDB which has amazing passwordless defaults and listens on ALL network interfaces rather than binding to localhost.

Sexual preference. Relationship status. Income. Address. These are just some details applicants for the controversial dating site BeautifulPeople.com are asked to supply before their physical appeal is judged by the existing user base, who vote on who is allowed in to the “elite” club based on looks alone. All of this, of course, is supposed to remain confidential. But much of that supposedly-private information is now public, thanks to the leak of a database containing sensitive data of 1.1 million BeautifulPeople.com users. The leak, according to one researcher, also included 15 million private messages between users. Another said the data is now being sold by traders lurking in the murky corners of the web.

But the information – which now appears to be real user data despite being hosted on a non-production server – was taken by one or more less-than-scrupulous individuals before the lockdown, making it out into the dirty world of data trading this year. That’s according to Troy Hunt, an Australian security expert who runs the website HaveIBeenPwned.com, where people can check if their own information has been leaked in some of the biggest breaches in recent memory, from Adobe to Ashley Madison.

It seems like the records are for sale on the shadier parts of the web and actively being traded by those who trade these kind of things. Fortunately payment details weren’t leaked, and passwords were encrypted.

So it’s a privacy issue more than a financial loss or threat, but as always this kind of info is a goldmine for social engineering, blackmail and identity theft.

Two BeautifulPeople.com users confirmed their information was in the leaked database, which also contained encrypted passwords. They shared their entries as found in the database, which showed an entry for descriptions of themselves, revealing more private details about their personal lives. One confirmed the latitude and longitude details were correct, pointing to Cambridge, UK, where they’d signed up.

BeautifulPeople.com, which brags about being “the largest network of attractive people in the world”, has courted controversy in the past by removing thousands of users from the service for not being attractive enough. In 2009, it boasted 1.8 million “ugly people” had been denied access to the site. In 2010, 5,000 were culled after gaining too much weight over a festive break. Last year, weight gain and ageing led to another 3,000 being thrown out.

Today, the company re-sent its original statement on the breach, first received by FORBES in December. “We can confirm we were notified of a breach on December 24th of 2015 of one of our MongoDB test servers. This was a staging server and not part of our production data base. The staging server was immediately shut down.” The company claimed all affected members were informed of “the vulnerability” in December, whilst noting passwords were encrypted and no financial data was exposed.

The user data apparently is only for users that signed up and were active before July 2015, anyone who joined after that shouldn’t be affected.

And yah, be careful with your staging servers – don’t have production data on them unless you absolutely have to (which honestly you don’t). You can mock whatever data structures you need to develop on it.

And don’t use MongoDB.

Source: Forbes

Share
Tweet16
Share107
Buffer
WhatsApp
Email
123 Shares

Filed Under: Exploits/Vulnerabilities, Privacy, Web Hacking Tagged With: exploit, mongodb, mongodb security, web-security



Reader Interactions

Comments

  1. Mariusz says

    April 28, 2016 at 7:53 pm

    C’mon, it wasn’t Mongo problem, but a stupid administrator who doesn’t know that default settings are usually not the best choice.

    • Darknet says

      April 29, 2016 at 11:54 am

      So why is necessary to listen on all interfaces by default? No other DB does that, that would have solved all these problems, binding to localhost by default like every other sane piece of software.

      • unknow says

        April 29, 2016 at 3:01 pm

        Sorry but by default MongoDB only listening on localhost….

        Stupid SysAdmin =/= Bad Database

        • Darknet says

          April 29, 2016 at 6:31 pm

          Only recently they’ve fixed that, and that’s not the only problem with MongoDB. Yah it’s an oversight by the sys-admin too, but MongoDB is terrible, we stopped using it in production 4 years ago and haven’t missed it at all.

      • Dave says

        May 2, 2016 at 1:54 pm

        MySQL listens on all interfaces by default.

        • Darknet says

          May 2, 2016 at 3:40 pm

          http://mixeduperic.com/downloads/org-files/ubuntu/etcmysqlmycnf-ubuntu-12041-default-file.html

          bind-address = 127.0.0.1

Primary Sidebar

Search Darknet

  • Email
  • Facebook
  • LinkedIn
  • RSS
  • Twitter

Advertise on Darknet

Latest Posts

Best Open Source HIDS Tools for Linux in 2025 (Compared & Ranked)

Views: 419

With more businesses running Linux in production—whether in bare metal, VMs, or containers—the need … ...More about Best Open Source HIDS Tools for Linux in 2025 (Compared & Ranked)

SUDO_KILLER - Auditing Sudo Configurations for Privilege Escalation Paths

SUDO_KILLER – Auditing Sudo Configurations for Privilege Escalation Paths

Views: 469

sudo is a powerful utility in Unix-like systems that allows permitted users to execute commands with … ...More about SUDO_KILLER – Auditing Sudo Configurations for Privilege Escalation Paths

Bantam - Advanced PHP Backdoor Management Tool For Post Exploitation

Bantam – Advanced PHP Backdoor Management Tool For Post Exploitation

Views: 386

Bantam is a lightweight post-exploitation utility written in C# that includes advanced payload … ...More about Bantam – Advanced PHP Backdoor Management Tool For Post Exploitation

AI-Powered Cybercrime in 2025 - The Dark Web’s New Arms Race

AI-Powered Cybercrime in 2025 – The Dark Web’s New Arms Race

Views: 588

In 2025, the dark web isn't just a marketplace for illicit goods—it's a development lab. … ...More about AI-Powered Cybercrime in 2025 – The Dark Web’s New Arms Race

Upload_Bypass - Bypass Upload Restrictions During Penetration Testing

Upload_Bypass – Bypass Upload Restrictions During Penetration Testing

Views: 557

Upload_Bypass is a command-line tool that automates discovering and exploiting weak file upload … ...More about Upload_Bypass – Bypass Upload Restrictions During Penetration Testing

Shell3r - Powerful Shellcode Obfuscator for Offensive Security

Shell3r – Powerful Shellcode Obfuscator for Offensive Security

Views: 726

If antivirus and EDR vendors are getting smarter, so are the tools that red teamers and penetration … ...More about Shell3r – Powerful Shellcode Obfuscator for Offensive Security

Topics

  • Advertorial (28)
  • Apple (46)
  • Countermeasures (228)
  • Cryptography (82)
  • Database Hacking (89)
  • Events/Cons (7)
  • Exploits/Vulnerabilities (431)
  • Forensics (65)
  • GenAI (3)
  • Hacker Culture (8)
  • Hacking News (229)
  • Hacking Tools (684)
  • Hardware Hacking (82)
  • Legal Issues (179)
  • Linux Hacking (74)
  • Malware (238)
  • Networking Hacking Tools (352)
  • Password Cracking Tools (104)
  • Phishing (41)
  • Privacy (219)
  • Secure Coding (118)
  • Security Software (233)
  • Site News (51)
    • Authors (6)
  • Social Engineering (37)
  • Spammers & Scammers (76)
  • Stupid E-mails (6)
  • Telecomms Hacking (6)
  • UNIX Hacking (6)
  • Virology (6)
  • Web Hacking (384)
  • Windows Hacking (169)
  • Wireless Hacking (45)

Security Blogs

  • Dancho Danchev
  • F-Secure Weblog
  • Google Online Security
  • Graham Cluley
  • Internet Storm Center
  • Krebs on Security
  • Schneier on Security
  • TaoSecurity
  • Troy Hunt

Security Links

  • Exploits Database
  • Linux Security
  • Register – Security
  • SANS
  • Sec Lists
  • US CERT

Footer

Most Viewed Posts

  • Brutus Password Cracker – Download brutus-aet2.zip AET2 (2,294,330)
  • Darknet – Hacking Tools, Hacker News & Cyber Security (2,173,085)
  • Top 15 Security Utilities & Download Hacking Tools (2,096,622)
  • 10 Best Security Live CD Distros (Pen-Test, Forensics & Recovery) (1,199,681)
  • Password List Download Best Word List – Most Common Passwords (933,487)
  • wwwhack 1.9 – wwwhack19.zip Web Hacking Software Free Download (776,146)
  • Hack Tools/Exploits (673,293)
  • Wep0ff – Wireless WEP Key Cracker Tool (530,157)

Search

Recent Posts

  • Best Open Source HIDS Tools for Linux in 2025 (Compared & Ranked) May 14, 2025
  • SUDO_KILLER – Auditing Sudo Configurations for Privilege Escalation Paths May 12, 2025
  • Bantam – Advanced PHP Backdoor Management Tool For Post Exploitation May 9, 2025
  • AI-Powered Cybercrime in 2025 – The Dark Web’s New Arms Race May 7, 2025
  • Upload_Bypass – Bypass Upload Restrictions During Penetration Testing May 5, 2025
  • Shell3r – Powerful Shellcode Obfuscator for Offensive Security May 2, 2025

Tags

apple botnets computer-security darknet Database Hacking ddos dos exploits fuzzing google hacking-networks hacking-websites hacking-windows hacking tool Information-Security information gathering Legal Issues malware microsoft network-security Network Hacking Password Cracking pen-testing penetration-testing Phishing Privacy Python scammers Security Security Software spam spammers sql-injection trojan trojans virus viruses vulnerabilities web-application-security web-security windows windows-security Windows Hacking worms XSS

Copyright © 1999–2025 Darknet All Rights Reserved · Privacy Policy