Digital Playground.com Hacked Credit Card Data Stolen.

You see for a while now we have had access to digitalplayground.com, one of the five biggest porn sites in the world.
But it doesn?t need any introduction from us.

This company has security, that if we didn?t know it was a real business, we would have thought to be a joke ? a joke that we found much more amusing than they will.

?This site has so many freaking holes that if I didn?t know it was a porn site, I would have mistaken it for a honeypot? ? [Redacted]

We did not set out to destroy them but they made it too enticing to resist. So now our humble crew leave lulz and mayhem in our path.
We not only have the 72k users of this site but also over 40k plaintext credit cards including ccvs, names and expiry dates.
If you want to hear more about those plaintext credit cards scroll through the MySql info further down. And of course as this is a porn site
there was no shortage of .mil and .gov emails in their user list.

We also went on and rooted four of their servers, as well as gaining access to their mail boxes. Using credentials from emails
we tapped into their conference call. ?Is anyone besides David on the line ?? ? We were. Did we win? Sure looks that way.

Digital Playground game over.

Wondered why their shit was down earlier, thanks for the info.

why is credit card information in plain text?

Maybe it's a ploy to provide a defense if they ever get hauled in Megaupload style?

"Judge, we didn't upload that video the hackers did!"

not great news for the industry

Damn that's not good.

Does Peggy = Peggy Mac?

Never heard of the group behind this...

Should be possible to track them:

https://twitter.com/#!/Th3Consortium

Could have serious repercussions for the entire industry.

ADG

no shit

sounds like a fun day for them

5th largest porn site ... 72k usernames ... numbers don't add up.

Almost as bad as if Media Revenue had purchased it instead of Manwin.

Sounds serious.

why is credit card info stored on the server in the first place, this was a requirement from visa/mastercard when sites had to be tested awhile back for compliance. Anyone storing credit card info on their servers is wrong. They give us all a bad name and will run off future customers because they cannot trust adult sites. They were totally wrong for storing CC info and I am sure visa will have issue with them.

ignore the nnumbers they really mean nothing if your trying to figure out how many members they have, you dont know if it was a back up file, if they merged password files with their other sites...same with the CC info, you dont know how many were long expired and how many were active... and calling them the 5th largest site, no one knows if that accurate..you guys get to caught up in the numbers, you need to know the structure to know the real deal.

Looks like just another wicked Manwin social promotion.

Good to see you posting again Venus

And you wonder why conversions are down..

Here is the full defacement: http://zone-h.org/mirror/id/17184557

All emails, logins and stuff can be found on hackbb..

Corporate bullshit FTW.

It needs to be in plain text in order to push through a transaction.

The question should be, why is this information available for read access on a public web server. Why isn't it on a separate backend server, which only accepts simple commands such as "charge $29.95 to credit card record #1234" and doesn't ever reveal the underlying data to the API caller?

Great, it's not like it isn't already hard enough having people buy memberships for porn sites, but now customers can read news like this and wonder if the same thing will happen to their information.

the fhg were not working for me.

http://join.digitalplayground.com/ga...AyMzY2LjAuMC4w Winne FHG
http://join.digitalplayground.com/ga...AyMzQ5LjAuMC4w Kissing Cousins FHG
http://join.digitalplayground.com/ga...AyMTc5LjAuMC4w Jesse Jane Red MooMoo
http://join.digitalplayground.com/ga...AyMTc4LjAuMC4w Jesse Jane Topless Yellow Thong

Sorry to hear about that.

dpincbill.com

If you are/were an affiliate of DP and used the same login/pass on other programs you'd better get busy changing up all your passwords.

http://www.esecurityplanet.com/hacke...te-hacked.html

The porn site Digital Playground was recently hacked by The Consortium, exposing 72,794 customers' user names, e-mail addresses and passwords, as well as more than 44,000 credit card numbers.

"They did not dump the 44,663 credit card numbers that they claim to have acquired, but note that card numbers, card expiration date, cvv and all customer billing address and contact info were in plain text,"DataBreaches.net reports.

"They provided two redacted versions of named customers as proof of that," the article states.

http://www.databreaches.net/?p=23518

The Digital Playground porn site has reportedly been hacked. Big time. The site that advertises “Porn worth paying for” may find itself paying dearly for a security breach that may have exposed over 72,000 customers’ details and over 44,000 credit card numbers.

In what they claim as their first release, a group calling themselves The Consortium (@Th3Consortium on Twitter) described the hack:

You see for a while now we have had access to digitalplayground.com, one of the five biggest porn sites in the world.
But it doesn’t need any introduction from us.

This company has security, that if we didn’t know it was a real business, we would have thought to be a joke – a joke that we found much more amusing than they will.

“This site has so many freaking holes that if I didn’t know it was a porn site, I would have mistaken it for a honeypot” – [Redacted]

We did not set out to destroy them but they made it too enticing to resist. So now our humble crew leave lulz and mayhem in our path.
We not only have the 72k users of this site but also over 40k plaintext credit cards including ccvs, names and expiry dates.
If you want to hear more about those plaintext credit cards scroll through the MySql info further down. And of course as this is a porn site
there was no shortage of .mil and .gov emails in their user list.

We also went on and rooted four of their servers, as well as gaining access to their mail boxes. Using credentials from emails
we tapped into their conference call. “Is anyone besides David on the line ?” – We were. Did we win? Sure looks that way.

Digital Playground game over.

Thankfully for the 72,794 users whose usernames, e-mail addresses and plaintext passwords were reportedly acquired, the hackers did not dump all of the data they claim to have acquired, but if they are possession of the data, that alone is cause for concern. They posted a smattering of the personally identifiable information they acquired:

■27 admins’ names, usernames, e-mail addresses, and encrypted passwords
■28 admins’ names, usernames, e-mail addresses, and encrypted passwords (some overlap with previous table)
■85 affiliates’ usernames, plaintext passwords, and in some cases, IP addresses
■100 users’ e-mail addresses, usernames (same as e-mail addresses) and plaintext passwords, and
■82 .gov and .mil e-mail addresses with corresponding plaintext passwords
They did not dump the 44,663 credit card numbers that they claim to have acquired, but note that card numbers, card expiration date, cvv and all customer billing address and contact info were in plain text. They provided two redacted versions of named customers as proof of that.

Clearly, if their claims are true (and I have no reason to disbelieve based on what they posted), this is bad. Really bad. So much personal information stored in clear text? Seriously? From Digital Playground’s Privacy Policy:

1. Information Security

Digital Playground, Inc. is dedicated to the protection of Site users’ information. To prevent unauthorized access to information provided to us, the Company uses a number of generally accepted industry standard procedures designed to effectively safeguard the confidentiality of your personal information. These procedures include secure server location, controlled access to data and equipment, robust redundant firewall software, network monitoring, adaptive analysis of network traffic to track and prevent attempted network intrusions and other network abuse and appropriate employee training in the area of data security. We shall continue to take reasonable steps to provide effective data protection at all times, however, because no security technology can provide invulnerability to information compromise, the Company cannot, and does not, guarantee the security of any information that you transmit to us or to any third party affiliated with the Site.

Apparently their dedication doesn’t extend to encrypting customer data or PCI DSS compliance.

At the time of this posting, DP’s homepage returns an error message. They have not yet responded to an inquiry I sent them this morning about the claimed hack.

h/t, Dump Centa

Update: The web site is back up with no notice and I’ve received no response to my inquiry yet. Interestingly, Digital Playground is operated by Manwin – the same firm that operates the Brazzers and YouPorn web sites that were recently in the news when they were hacked. According to Manwin’s statement in the previous reports, this site appears to have had less security than Brazzers, as in that case, user passwords were reportedly encrypted and credit card data were not compromised.

WOW thats must hurt them big time

Thanks DVTimes for posting the news after the OP already told us.

Useful as ever.

Last big security breach I remember like this was about 2 years before Manwin was born, on a system Nathan created.

Fast forward to Manwin owning the internet, then comes another big security breach on a site Nathan owns, after his biggest tube and Brazzers forum were hit.

Some guys have all the luck.

Looks to me like someone has a bone to pick with the guy / his company.

Nah. He's just big enough to make it into the news. Truth is that that site was breached for years, but noone cared. Most of the companies don't care even if they know it, until it hits the news. This consortium crap is probably some kids that want the fame after someone posted DP info elsewhere. Seen this MO far too many times. People just don't care until it hits the news.

Swiftwill is on the case now, i'd like to see it happen now.

Most of the sites on the net get breached at one point or another, especially pron sites. But yeah vast majority of cases won't ever hit the public news, either the breach was not done by some attention seeking kids or the site was not big enough.

But a good reminder that it's not safe to use the same password in any place that you consider important, or the same email everywhere. And storing full cc info doesn't sound like a good practice.

And there do seem to be some common patterns in the recent news around this subject, manwin.. anonymous...

That's what you get for paying for porn ...

I've seen site owners that have ignored breaches completely. Only time they care is if it's made public. Also, it's quite laughable how these fame seeking kids claim "5th largest porn site with 72k users". From what i read in the release, that seems like a database with members from several years back, and if it held only 72k users, it's pretty fucking small. That would amount to few k active subscribers.

Strange things going on lately

Sucks....

the title is kind of fucked up

makes one believe Digital Playground hacked credit card data which got stolen afterwards

Maybe it is pretty old, the emails they posted were from 2009/2010.

i wonder why they did not email webmasters to tell them.

they still are not working.

I hate when this shit happens. It makes surfers lose trust even more in joining paysites.

From AVN:

Digital Playground.com Victim of Huge Security Breach

Some fairly prompt damage control with regards to the Members. I hope that they catch the culprits.

ADG

Good, DP rejected me as an affikate. Fuck DP!

Hey Theo....Yer welcome LOL....

WOW!! Get those cards and bang them all!! hahaha!! What a big loss! Kidding!!

This is a Trifecta of very disturbing news.

From DP's Twitter:

We made the movie Pirates, but fight internet pirates...

Reading the damage last night how they attacked every single server one by one and laughed about. Amazing.