Cyber Incident Victim: PureMatrimony.com
Date:
May 2017
Location:
United Kingdom
Summary
PureMatrimony.com, a Muslim-focused dating platform, suffered a data breach involving approximately 120,000 password hashes leaked on a hacking forum. The compromised credentials were weakly secured with MD5 hashing, allowing attackers to easily decipher common passwords like "purematrimony" or "purematrimony1." While the exposed data lacked usernames or email addresses, the company notified users to reset passwords and reported the incident to UK authorities. It attributed the breach to a third-party service vulnerability, implemented enhanced security measures including server migration, and engaged independent consultants to bolster protections. The incident mirrored prior breaches affecting similar niche dating platforms.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
In May 2017, PureMatrimony.com, a Muslim-focused dating platform with over 100,000 members, experienced a security incident involving the exposure of user password data. Approximately 120,000 password hashes linked to Pure Matrimony accounts appeared on a password-cracking forum, as documented by Motherboard. These hashes utilized the MD5 algorithm, which security experts consider cryptographically weak due to its vulnerability to rapid decryption methods. Forum participants successfully cracked numerous hashes, revealing common low-complexity passwords such as "purematrimony" and "purematrimony1." The exposed data did not contain associated usernames, email addresses, or other personal account information, limiting immediate identification of affected users but exposing credential reuse risks. Pure Matrimony notified its user base via email, instructing them to reset their site passwords and update identical credentials used elsewhere.
The company publicly disputed claims of a direct breach of its infrastructure, attributing the incident instead to a suspected vulnerability in an unspecified third-party service provider. This assertion remained unverified by independent analysis. In response, Pure Matrimony engaged two independent security consultants to audit its practices, implemented additional protective measures, and migrated its website to a new server infrastructure. The incident was formally reported to the UK Information Commissioner’s Office (ICO) in compliance with data protection regulations. The breach followed a pattern of attacks targeting niche dating platforms, as evidenced by a separate 2016 compromise of Muslim Match, where attackers exfiltrated private user messages. Pure Matrimony’s public communications emphasized proactive member notification and infrastructure hardening but did not disclose technical specifics of the third-party vulnerability or the exact data exposure timeline.