Millions of users of a major adult live streaming platforms have had their identities leaked online after the site suffered a massive data breach.
CAM4 suffered a significant incident caused by a server configuration error, making 7TB of user data (comprising 10.88 billion records in total) easily discoverable online, according to security researchers at Safety Detective.
While the misconfigured ElasticSearch database did not betray users’ specific sexual preferences, it did include personally identifiable information including names, email addresses, payment details, chat logs and sexual orientation.
CAM4 data breach
The popular adult platform is used primarily by amateur webcam models to stream explicit content to live audiences. To gain access to premium content or tip performers, users must first register with the site – parting ways with both personal and financial data.
According to the researchers, there is no evidence the breach was caused by a cyberattack or that data was siphoned from the database. However, incidents such as this do form the basis of the main argument against closer regulation of pornographic websites – a project abandoned by the UK over fears user privacy could be compromised in the event of a breach or hack.
Neither is the timing of the CAM4 breach fortuitous, with traffic to pornography websites through the roof as a result of the coronavirus pandemic. Pornhub, for instance, saw traffic spike by 24.4% in late March, in line with the widespread introduction of lockdown measures.
It is unclear precisely how many CAM4 users were compromised, but analysis suggests records relating to circa 6.6 million US users were present on the server, with Brazilians, Italians and the French also among the most widely represented demographics.
Thankfully, only a few hundred entries revealed both a user’s full name and credit card information – a particularly dangerous combination due to the opportunity for financial fraud.
CAM4 did not immediately respond to our request for comment, but has since secured the vulnerable server.
