The Friendship Key Breach: 56,709 Plaintext Passwords Hit the Dark Web

HEROIC analysts identified a breach connected to Friendship Key, a US-based dating site at friendshipkey.com, that exposed 56,709 user records. The breach dates back to November 17, 2015, and the exposed data set includes email addresses and passwords stored in plaintext.

Why the Friendship Key Breach Is Especially Risky

Storing passwords in plaintext means there was no hashing standing between attackers and a fully readable password list. Anyone who obtains this data sees exactly what each user typed when they signed up, no cracking tools required. Combined with an email address, that is an immediately usable login for any other account where the same password was reused, and given the nature of a dating site, exposure here can also carry a personal privacy dimension for the people involved.

What Was Exposed in the Friendship Key Breach

• Email addresses
• Passwords (stored in plaintext)

Why This Matters for Friendship Key Users

Because these passwords require no cracking, attackers can plug them directly into automated credential stuffing tools and test them against email providers, banking sites, and social media platforms. If you signed up for Friendship Key and reused that password anywhere else, that other account could be compromised the moment this data circulates, regardless of how long ago you created the account.

How a Plaintext Database Breach Happens

A plaintext password breach happens when a website stores passwords exactly as users type them, without applying any cryptographic hashing. When attackers exploit a vulnerability or misconfiguration to access that database, they get a fully readable list of accounts. That data is then typically posted or sold on breach forums, where it can continue to circulate and resurface for years, as happened here nearly a decade after the original breach.

Check If You Are Affected

With over 56,000 plaintext passwords exposed, this breach remains a ready-to-use resource for credential stuffing attacks. HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records, including this one, so you can find out in seconds whether your information was exposed and change any reused passwords right away.