AllMyFavorites.net Data Breach: 42,504 Bookmark Users Exposed

42,504 Bookmark Users Exposed: The AllMyFavorites.net Data Breach

AllMyFavorites.net, a US-based free online boomarks management service, suffered a data breach in November 2017 that exposed 42,504 user accounts. The breach extracted email addresses and plaintext passwords -- credentials stored in clear text with no hashing protection whatsoever. The platform has since become defunct, but the acounts and passwords extracted from its database have continued to circulate in credential markets across multiple years, finding new utility in successive credential stuffing campaigns as password reuse patterns persist among affected users.

AllMyFavorites.net (November 2017): Breach Summary

• Records Exposed: 42,504
• Data Types: Email addresses, plaintext passwords
• Breach Type: Database breach / Combolist
• Password Type: Plaintext -- stored without hashing; immediately usable by any attacker with the dataset
• Country: USA
• Date Leaked: November 23, 2017

The Defunct Platform Problem: Data Outlives the Service

AllMyFavorites.net is no longer operational, but this closure provides zero protection to the 42,504 users whose credentials were extracted in November 2017. Credential data circulates independently of the platform that generated it. Once a database has been posted to hacking forums and incorporated into combolists, it persists in criminal infrastructure indefinitely -- merged with other datasets, re-indexed by new actors, and tested against new target platforms as they emerge.

The trajectory of the AllMyFavorites.net data illustrates the long tail of plaintext credential exposure: extracted in late 2017, incorporated into combolists throughout 2018 alongside other breaches from the same period, retested in new credential stuffing campaigns as major platforms deployed updated authentication systems, and remaining active more than six years after the initial breach. Users who registered on the platform and have not changed those passwords remain exposed today.

Web Tool Users and Cross-Platform Credential Exposure

Bookmark management tools attract web-savvy individuals who maintain large numbers of browser favortes and typically manage accounts across many platforms simultaneously. This demographic is also more likely than average to use the same email and password across a wide range of web services -- precisely because managing dozens of unique credentials without a password manager is cognitively expensive, even for technically proficient users.

The AllMyFavorites.net plaintext password, once extracted, represents a key that may unlock dozens of downstream accounts: social media profiles, email accounts, cloud storage services, and platform subscriptions. The more accounts a user maintains with the same credential, the more valuable a single plaintext breach becomes to attackers constructing combolists for credential stuffing campaigns.

The November 2017 Breach in Historical Context

The AllMyFavorites.net breach predates the large 2018 extraction waves by several months, placing it at the leading edge of a sustained period of credential harvesting that continued well into 2019. Other breaches from adjacent periods -- including ChartNex (April 2019), 35fg.net (April 2019), and ASAP.me (February 2018) -- were incorporated into the same combolist ecosystems, creating aggregated datasets where the AllMyFavorites.net credentials are regularly packaged alongside data from dozens of other platforms for use in automated attacks.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records -- including data from the AllMyFavorites.net breach and hundreds of other incidents. If your email appears in this dataset, you'll know at HEROIC.com -- and you can take action before your credentials are used against you.