Luscious Data Breach 2019: 1.2 Million Profiles, What To Do

In August 2019, the adult site Luscious left a database of about 1.2 million user profiles open on the internet with no password. Researchers could read usernames, private email addresses, countries, genders and full activity records. They found no passwords in it. The web host closed access on August 19, 2019, and nobody has said whether anyone else copied the data first.[1][2][3]

This guide is for anyone who ever signed up to Luscious, and for anyone who wants to understand how an anonymous account can be traced back to a real person. We first published a short report on August 20, 2019. We have now rebuilt it from the primary research and the original press coverage, kept every fact that still holds, corrected two details, and added the steps that matter if your address was in the file. The incident is seven years old, but the exposed data does not expire.

Luscious data breach timeline

The dates below come from the researchers' own report and from the reporter who helped get the database closed.

• August 4, 2019. Data from the search engine Shodan shows the database exposed since at least this date, according to TechCrunch.[2]
• August 15, 2019. vpnMentor researchers find the unprotected server during a web mapping project.[1]
• August 16, 2019. The researchers contact the site owner.[1]
• August 19, 2019. The web host blocks access after TechCrunch passes on a message. TechCrunch and vpnMentor publish. Only then does the owner answer and confirm the lapse.[1][2]
• August 20, 2019. CNET, ZDNet, SiliconANGLE and Forbes report the story, and our own first article appears.[3][4][5]

What happened to the Luscious database

Luscious is a niche adult image site that focuses on animated content uploaded by its own users. The researchers counted more than one million registered users, each with a profile that lets them upload, share, comment and discuss content behind a username.[1] The researchers put the site at over 20 million visits a month, and TechCrunch noted that it ranked in the top 5,000 sites in the United States by traffic in the Alexa data of that time.[1][2]

The weakness was simple. The site ran an Elasticsearch database that required no login, and the researchers could open it in an ordinary browser and change the search terms in the address to read records.[1] This is a configuration mistake, not a break-in by a clever attacker. Anyone who found the server could read it, and tools such as Shodan exist precisely to find servers like this.

TechCrunch was given exclusive details and spent about a week trying to reach the owner. The reporter used the email address found in the very first user record, then the site's contact form, Facebook Messenger, a LinkedIn request and text messages based on historical registration data. Nobody answered.[2] A message to the web host finally led to access being blocked, which let the story run. After publication the owner confirmed the lapse and said the site would warn users who may have had private email addresses exposed.[2]

TechCrunch also checked that the data was current. The reporter created a new account and found the username in the database almost at once, which showed that the database was live and updating and not an old backup file.[2] The exposed database appeared to hold the site's entire back end, including more than 235,000 albums, 30,000 user blog posts and 900 videos, plus records about 19.7 million photos.[2]

What data was exposed in the Luscious breach

The researchers and the press agree on the core list. Most of it is hidden from other members during normal use, which is why people felt anonymous. The table groups the fields by how risky they are.[1][2][3]

One detail of the original reporting deserves a closer look. The researchers said that some blog posts on the site were extremely personal, including depressive or otherwise vulnerable writing, and that these had been kept anonymous until the database was exposed.[1][4] For those writers, the harm was not only a risk of fraud. It was the loss of the privacy they had chosen on purpose.

Who is affected by the Luscious breach

Anyone who registered a Luscious account before August 2019 may have had a record in the database. The researchers saw accounts from Europe, Asia, Australia and the Americas.[1] They estimated user counts per country from the email domains and from Gmail addresses with local names, so the figures below are the team's own estimates and not a verified census.[1]

The same report also listed the Netherlands at 8,000, Sweden at 6,000, Japan at 6,000, India at 6,000, Australia at 5,000 and Israel at 1,000.[1] The researchers estimated that about 20 percent of accounts used fake or throwaway email addresses at sign up, which suggests that some users were already taking steps to stay hidden.[1][4] TechCrunch tested real accounts and found that many of the remaining emails were real and allowed it to identify real people.[2]

A smaller group carries extra risk. The researchers found members who had signed up with official email addresses. They counted dozens of .gov addresses and fewer than a thousand .edu addresses, and named government examples from Brazil, Australia, Italy and Malaysia.[1][5] A work address ties the account to an employer, and that gives a criminal a second target to pressure.

What attackers can do with this data

This section is our analysis, based on the exposed fields and on the risks the researchers named. We found no public report of a specific attack that used this database.

• Expose a person. An email address and a location make it easy to find social media profiles. The researchers called this doxing and warned that a user could be shared with family, friends or an employer.[1]
• Demand money. A criminal can write to a user and threaten to reveal the account unless a payment is made. The researchers noted that paying does not guarantee silence, because stolen data can be sold and reused many times.[1][4]
• Phish with real details. A message that quotes a real username or the name of the site looks more believable than a generic spam email, and it lands in the inbox of the very person it targets.[1][6]
• Target an employer. A message sent to a work address can be used to pressure the employee or to probe the organization behind the domain.[1]
• Study the audience. The researchers pointed out that competitors could read the favorites and behavior of users and use the data for marketing.[1]

Some of these risks have a time limit and some do not. A phishing message works only while the account details are fresh. A threat to reveal a hobby can be written years later, because a person's email address and past activity do not change when a database is closed.

What to do if you had a Luscious account: six free steps

1. Retire the email address you used. The researchers advised changing your Luscious username and the email linked to the account.[1][5] For any sensitive site, use a new address that has no link to your name, your employer or your other accounts. If you cannot change the address at the site, close the account. Keep the old inbox, because you will need it to receive and read warnings, but do not use it for sensitive sign ups again.

2. Change any password you reused. No passwords were in the database, so a Luscious password was not leaked by this lapse.[2] The risk comes from other places where you used the same password or the same email. Create a new password for each account, and turn on multi-factor authentication where it is offered. The FTC explains that this makes it harder for scammers to log in even if they hold your username and password.[6]

3. Never pay a threat. If someone writes that they hold your Luscious details and will expose you, do not pay and do not answer. The FBI warns, in cases involving minors, that offenders often release material whether or not they are paid.[8] The researchers say something similar about Luscious users: stolen data can be used and sold again, so payment does not end the problem.[1] Keep the message and take a screenshot of it.

4. Do not click, call back or open attachments. The FTC advises that when a message asks you to click a link, you should ask whether you have an account with the company or know the sender. If not, report it and delete it. If you do, contact the company using a phone number or website you know is real.[6] A message that quotes your username is not proof that it comes from Luscious.

5. Report it and get images removed if needed. Report fraud and scam messages to the FTC at ReportFraud.ftc.gov, and forward phishing emails to reportphishing@apwg.org.[6][7] The FBI points adults to StopNCII.org to help remove intimate images shared without consent, and warns that victims should never have to pay a fee to get such help.[8] Our guides explain how to report a phishing email and how to report cybercrime.

6. Trim what your old accounts show. The researchers suggested removing your location from your profile if you revealed it.[1][5] Take out real names, work details and links to other profiles from every old account, or close the account. If you paid a scammer, act at once: our guide on what to do after paying a scammer lists the steps by payment method.

One note on tools. vpnMentor suggested that you can change your location by using a VPN.[1] vpnMentor discloses on its site that it works in partnership with Kape Technologies, which owns several VPN products, and that its rankings may take that into account.[1] A VPN hides your connection address from the sites you visit. It does not change an email address that is already in a leaked file, so treat it as a minor extra and not a fix.

Scams and extortion to expect after the breach

Old leaks keep feeding new scams, because criminals reuse lists of addresses for years. Treat any message that mentions adult content, your account or a threat to expose you with suspicion, and check it against the patterns below.

• A message that says it has your browsing history or recordings and demands payment in cryptocurrency or gift cards. Many of these are bulk emails that rely on fear. Our guide to the I know your password email scam explains how to recognize one.
• An email that claims to come from Luscious and asks you to confirm your account, change your email or verify your age through a link.
• A message that threatens to send details to your family or employer, naming your real name, which could come from a leaked address that contains it.
• A service that offers to remove your leaked data for a fee. The FBI warns about for-profit companies that charge sextortion victims for help and says victims should never have to pay for removal assistance.[8]

The FTC lists the tell-tale signs of phishing: a story about a problem with your account, a request to confirm personal details, or a link that you are told to click. Real companies do not email a link to update your payment information.[6] If you did respond to a message, the FTC says to go to IdentityTheft.gov for steps matched to the information you gave, and to update your security software and run a scan if you opened a link or file.[6][7] Before you open a link in any message, paste the address into our website checker.

How this breach compares with other incidents

Luscious was one of several open database cases reported in the same months of 2019. The comparison below uses only what the cited reports say, so the details for each row differ.

The pattern is the same in most of these cases. A company stores sensitive records, skips basic access controls and learns about the problem from researchers or a reporter. The researchers who found Luscious said the exposure could have been avoided with basic steps: secure the servers, set proper access rules and never leave a system without authentication open to the internet.[1] TechCrunch described the whole class of incidents as companies failing to protect data with a password or basic security.[2]

For a running list of confirmed incidents, see our data breaches hub.

What changed since our 2019 report

We kept the facts of the original article that still hold. These are the discovery on August 15, the contact with the owner on August 16, the closure on August 19, the exposed fields, the country estimates and the advice to change your username and email. We changed the points below after reading the sources again.

• The researcher's name. The original article misspelled it as Roten. The correct name is Noam Rotem.[1][5]
• Government and school emails. The original said a few hundred such addresses. The researchers' own table says dozens of .gov addresses and fewer than a thousand .edu addresses.[1]
• Number of users. The researchers counted 1.195 million accounts. TechCrunch wrote 1.1 million. We use about 1.2 million and say which source gives which figure.[1][2]
• Exposure date. The original gave only the discovery date. TechCrunch added that Shodan data shows the database exposed since at least August 4, 2019, which is eleven days before discovery.[2]
• Passwords. We now state plainly that no passwords were in the database.[2]
• Public breach listings. New in this version: Have I Been Pwned lists 1,039 breached sites and none of them is Luscious.[9]

What is still unknown

• Whether anyone other than the researchers and the reporter copied the data before access closed. The researchers said that other hackers could have read it earlier.[5]
• Whether the owner actually warned affected users. The owner said so, but the reports we read do not show that any notice was sent.[2]
• How long the database sat open before August 4, 2019, since Shodan data can only show that it was exposed from at least that date.[2]
• Whether the records were ever sold, traded or published, and whether any user was extorted as a result.
• Whether regulators in Europe, where tens of thousands of users lived, opened any inquiry. None of the sources we read mention one.

We will update this article when new facts become public. It was last checked on October 6, 2026, and we found no newer reporting on the incident.