The account details of 250,000 users of the Dutch website Hookers.nl have been leaked after a vulnerability was exploited on the website. A hacker stole members' data and put it up for sale – NOS conducted its own investigation after an anonymous tip. The website is popular among clients of sex workers, who exchange advice, comments and experiences in the sex.
The problem extends beyond the clients of sex workers. The sex workers themselves are also active on the site. They may or may not want to publicly identify themselves as sex workers under their real names.
The leaked data includes email addresses, usernames, IP addresses and passwords. The passwords are encrypted, but the email addresses are readable. NOS examined some of the leaked data, which showed that many users were using a pseudonym for their username, but their real names are found in the email used to open an account.
The hacker is offering to sell the data for $300 to any person willing to buy it. The hacker said he hasn't sold the data yet, but expects to do so.
Hookers.nl confirmed the data breach to the broadcaster and promised to notify all users on Thursday morning. The issue arose after a technical weakness in the vBulletin Forum software was revealed just a few weeks ago. The hack took place before the site's administrators had time to apply a patch, which was first announced on September 25, according to Tweakers.net.
The Midhold organization behind the site, Midhold, is aware of the sensitivity of these leaks. “It’s not an ISP account that was leaked, but it’s understandable that you wouldn’t want people to know that you have an account here,” said Midhold spokesman Tom Lobermann. “We’re not happy about this.”
The biggest threat to website users is blackmail, said Arda Gerkens of the Help Wanted foundation, which helps victims of sexual abuse. "Some people don't hide that they work in the sex industry, but it's certain that when people use a pseudonym they want to maintain their anonymity ," Gerkens said.
This is not the first time that user data has been leaked from a controversial website. Four years ago, personal data of members of the dating site Ashley Madison ended up with hackers. Subsequently, many users divorced, their marriages ended, and even several suicides were linked to the data breach, according to NOS.
