Report: Massive Porn Site Breach Exposes Personal Information of Cam Models

A recent report from the cybersecurity team at vpnMentor has revealed that a porn site has suffered a massive data breach, exposing the personal data of 4,000 adult cam models — including scans of passports and driver’s licenses, and model releases disclosing names of family members, phone numbers, and other private information.

vpnMentor reports that its cybersecurity team led by Noam Rotem and Ran Locar have discovered a vulnerable Virginia-based Amazon server belonging to the adult entertainment site “PussyCash” and its network. The website is an explicit “cam” affiliate network that owns multiple brands such as ImLive which allows users to watch adult cam models live streaming on the platform.

The vulnerable server resulted in the private data and likeness of over 4,000 models along with 875,000 files being exposed, leading to real-life implications for the models according to vpnMentor. Far beyond basic information and the models’ pictures, the leak includes scans of identification including passports and driver’s licenses, and model releases including a wide range of information including the names of models’ parents.

The owner of PussyCash is listed as I.M.L. SLU, a firm registered in Andorra. PussyCash hosts affiliation programs for multiple adult sites and pays webmasters for traffic sent to the sites through banners and other means.

PussyCash boasts a membership of 66 million users on their webcam chat arena ImLive, its other sites which include Sexier.com, FetishGalaxy, Supermen.com, Shemale.com, CamsCreative.center, forgetvanilla.com, idesires.com, Phonemates.com, SuperTrip.com, and sex.sex, add even more to the company’s user count. Some of PussyCash’s partners include major adult entertainment sites BeNaughty, Xtube, and Pornhub.

vpnMentor outlined their discovery of the exposed server writing:

Date discovered: January 3, 2020
Date company (PussyCash & ImLive) notified: January 4, 2020
Data Amazon notified: January 7, 2020
Date of reply from ImLive: January 7, 2020
Date of action: January 9, 2020

PussyCash never replied to any of our attempts to contact them regarding the data leak, including their Data Protection Officer. ImLive finally responded to one of our emails, stating that they would take care of it and pass on the information to the PussyCash tech team.

As PussyCash doesn’t hire talent through their main website, it is plausible to assume that their leaking data is from one or more of their other websites, such as ImLive. This is an assumption that we cannot prove without digging further into the data leak. We also saw records specifically mentioning ImLive, which is why we have chosen to use that as an example for portions of this report, and not necessarily the other PussyCash brands and sites. However, it is worth noting that the Bucket itself is named after PussyCash.

According to vpnMentor the documents available on the server included:

Photographs and scans of full passports and national identification cards, including visible:

• Full name
• Birth date
• Birthplace
• Citizenship status
• Nationality
• Passport/ID number
• Passport issue & expiration dates
• Nationally registered gender
• ID photo
• Personal signature
• Parent’s full names
• Fingerprints
• Additional country-specific details (e.g. emergency contact information for UK citizens)

Photographs and scans of Driver’s Licenses, including visible:

• Driver’s License number
• Photo
• Date of birth
• Height/weight
• Registered gender
• Full address
• Signature
• Type of vehicle the individual is permitted to operate
• Additional PII, varying by country (such as organ donor status and visual impediments for US citizens)

US Uniformed Services Identification card:

• Branch of service (e.g. Army)
• Military rank
• Color coding (denotes the holder’s current status: retired, active, privileged, dependent of military servicemen)
• Full name

Photographs and scans of Credit Cards, including visible:

• Full credit card number
• Expiration date
• Cardholder name

Model release forms, including:

• Full legal name
• Professional aliases
• Signature
• Date of birth
• Address
• Phone number
• Passport/ID number
• Photographer’s name and address
• Witness name and address
• Body measurements (height, weight, hips, bust, waist)
• Details of piercings, tattoos, and scars
• Rates

• Full name
• Spouse’s full name
• Occupation
• Age
• Parents’ names
• Date of marriage
• Place of marriage

Birth certificate scans:

• Full birth name
• Birth gender
• Date of birth
• Place of birth
• Nationality
• Parent’s names

Handwritten bios, including:

• Sexual preferences (ie attractions, fantasies, methods)
• Hopes and dreams
• Current occupation
• Favorites, from music to food to hobbies

Read the full report from vpnMentor here.

Lucas Nolan is a reporter for Breitbart News covering issues of free speech and online censorship. Follow him on Twitter @LucasNolan or email him at lnolan@breitbart.com