Cyber Incident Victim: ElSurveillance
Date:
Jul 2016
Location:
Australia
Summary
A breach impacted two Muslim dating platforms, compromising user data including email addresses and authentication credentials. One service exposed over two million accounts with passwords stored in unencrypted plaintext, while the other leaked approximately 150,000 user profiles alongside 790,000 private messages, utilizing weakly hashed MD5 password protection. The incidents occurred within weeks of each other, with stolen records subsequently appearing in public databases and breach notification services. This followed separate compromises of two additional dating platforms targeting different demographics, though those intrusions involved significantly fewer accounts and originated from distinct threat actors.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 6 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
The ElSurveillance incident involved unauthorized access to multiple online dating platforms, primarily targeting Muslim-focused services in July 2016. On July 10, attackers breached Shadi.com, a Muslim dating portal, compromising 2,035,020 user records containing email addresses and passwords stored in cleartext. LeakedSource obtained and verified this dataset, marking the second major breach of a Muslim dating site within two weeks. Earlier in July, security researcher Troy Hunt reported MuslimMatch.com had been compromised, exposing 150,000 user accounts alongside 790,000 private messages. Unlike Shadi.com, MuslimMatch.com had implemented MD5 hashing for password storage, though this weaker cryptographic method still posed significant risks. These incidents followed a separate June 2016 breach by a Moroccan hacker targeting AfrikaDating.com (12,738 records) and AdultSingleSites.com.au (67,118 records), though this activity appeared unrelated to the July attacks against Muslim platforms.
The breaches exposed sensitive personal information across multiple jurisdictions, with Shadi.com's cleartext password storage substantially increasing risks of credential reuse attacks. LeakedSource and Have I Been Pwned? served as primary verification channels for affected users, though neither platform provided details about intrusion methods or perpetrator identities. The publication of private messages from MuslimMatch.com created additional privacy concerns beyond credential exposure. No containment measures or official responses from the affected companies were documented in available sources. The cumulative impact spanned over 2.2 million directly affected users across the two Muslim dating platforms, with secondary risks extending to any services where victims reused compromised credentials. The incidents highlighted security vulnerabilities in niche dating platforms handling culturally sensitive data.