Fling Data Breach (2011): What Was Exposed & What To Do

In March 2011, reports emerged that the adult-oriented social network Fling had suffered a data breach affecting 40.8 million accounts. The incident exposed a range of personal details, including email addresses and passwords stored without encryption. Public records of the event remain limited to the scale reported at the time and the categories of information listed as obtained by the attacker.

Incidents involving large volumes of user records from online platforms continue to occur, often revealing how personal data collected for service operation can persist long after initial collection. The Fling case stands out because of the sensitive nature of some of the attributes involved and the plain-text storage of passwords, both of which increase the potential for downstream misuse.

Breaking down the breach

The breach was reported on 10 March 2011. Contemporary accounts state that more than 40 million user accounts were obtained. The data categories listed as exposed include dates of birth, email addresses, genders, geographic locations, IP addresses, passwords, phone numbers and sexual fetishes. The reported summary notes that passwords were stored in plain text rather than in hashed form.

No further technical details, such as the precise method of intrusion or the timeline of access, appear in the available records. The total number of unique individuals affected is given as 40.8 million, though independent verification of that figure is not provided in the original reporting.

How a breach like this happens

Breaches affecting online platforms commonly begin with an attacker gaining unauthorised access to a database or application server. Once inside, the actor can copy stored records without triggering immediate detection if logging and monitoring are limited. In cases where credentials are stored in plain text, the copied data can be used directly rather than requiring additional cracking steps.

Adult-oriented services often maintain large user bases and retain detailed profile information to support matching functions. When such databases are not segmented or encrypted at rest, a single successful intrusion can result in the bulk export of both account credentials and the personal attributes attached to those accounts.

About Fling

Fling operated as a social-networking site focused on adult users and described itself as the “World’s Best Adult Social Network.” Services of this type collect and store contact details, demographic information and explicit preference data to enable user interactions. The combination of account credentials with sexual-fetish and orientation information distinguishes the dataset from many other consumer-platform breaches.

Because the platform’s purpose centred on personal and intimate connections, the records held by Fling were inherently more sensitive than those typically found in general-purpose social or retail sites. A compromise therefore carries implications beyond routine account takeover, extending to potential reputational or relational harm for affected individuals.

The information in question

The breach records name the following data elements: dates of birth, email addresses, genders, geographic locations, IP addresses, passwords, phone numbers and sexual fetishes. Passwords are specifically noted as having been stored in plain text. No additional categories or file inventories have been publicly disclosed.

Organisations in this sector routinely hold profile photographs, private messages and payment details, yet the exact contents of the 2011 Fling dataset beyond the listed fields remain unconfirmed. Without a published forensic report, it is not possible to determine whether further data types were present.

Why it matters

Exposure of email addresses paired with plain-text passwords allows attackers to test those credentials against other services, increasing the chance of account takeover elsewhere. The presence of sexual-fetish and orientation data adds a layer of potential embarrassment or targeted harassment that does not accompany more generic personal records.

For the organisation, the incident illustrates the long-term liability created by retaining large volumes of identifiable information without adequate protective controls. Individuals whose records were included face ongoing uncertainty about where copies of the data may still circulate.

If your data was in this breach

Anyone who created an account on Fling should assume their listed email address and password have been exposed. The immediate steps are to change the password on any other service that used the same credentials and to enable multi-factor authentication where available. Monitoring email accounts for unusual login attempts and watching for phishing messages that reference the breach can reduce further risk.

Readers can run a free exposure scan of their email address against known breach datasets to determine whether their information appears in this or other incidents. No remediation can fully undo the original exposure, but prompt credential hygiene limits the practical impact.

AICompiled with AI assistance from public sources and published under our editorial standards.