eHarmony Hacked
Summary: eHarmony began urging users to change passwords after KrebsOnSecurity alerted it to a claimed breach; CTO Joseph Essas said researcher Chris "Ch" Russo found a SQL injection flaw in a third-party content management library on advice.eharmony.com, exposing screen names, email addresses and hashed passwords, with no sign the main eharmony.com site was affected. A forum seller using the nickname "Provider" advertised access to eHarmony infrastructure for $2,000 to $3,000, and Essas said Russo had offered to sell the company security services, which eHarmony declined and is exploring legal remedies over.
Bottom line: The compromised data sat in a third-party library eHarmony did not control the source code for, so the fix was a network-layer block and vendor patching rather than a direct repair - the same gap a security leader carries for every outside component in their stack.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026