Cyber Incident Victim: EscortReviews.com
Date:
Sep 2018
Location:
United States of America
Summary
A hacker compromised an adult services review forum, stealing its database containing registration details for over 470,000 members, including display names, email addresses, weakly hashed MD5 passwords, optional Skype identifiers, birthdays, and IP addresses. The breach likely exploited known vulnerabilities in the site's outdated vBulletin software or an exposed database backup, leading to the platform's subsequent inaccessibility. Exposed sensitive user data from the highly active community poses significant risks of credential reuse attacks and targeted extortion due to the nature of the platform's content.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 3 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
The EscortReviews.com data breach occurred when a threat actor obtained and publicly distributed the site's vBulletin forum database around September 2018. The compromised database contained registration details for 472,695 members, including display names, email addresses, MD5-hashed passwords, optional Skype accounts, optional birthdates, and IP addresses. The adult-oriented platform, which facilitated client reviews of female escorts in the US and Mexico, hosted over 2.4 million discussion topics and 12.5 million posts prior to the incident. Cybersecurity firm Cyble identified that the stolen records included data current through September 2018. The website became inaccessible following the breach, displaying vBulletin database errors, though it remained unclear whether this resulted from the hack or permanent shutdown. Google's last cached version dated to January 2021.
Verification efforts confirmed the breach's validity when at least one contacted member acknowledged their exposed information as accurate. The site operated on vBulletin 3.8.9, a version with documented security vulnerabilities that could enable unauthorized access, though investigators couldn't determine whether these flaws or an exposed database backup caused the compromise. Due to the weak MD5 password hashing implementation, cybersecurity professionals warned that credentials could be readily cracked and advised members to change reused passwords elsewhere. The breach exposed victims to potential blackmail and sextortion campaigns, paralleling risks observed after the 2015 Ashley Madison incident. Affected individuals could check their exposure status through Cyble's AmIBreached notification service. Historical precedents indicated such breaches could lead to severe personal consequences, including documented cases of suicide following public exposure of sensitive activities.