{"id":692187,"date":"2026-05-25T07:35:11","date_gmt":"2026-05-25T07:35:11","guid":{"rendered":"https:\/\/www.newsbeep.com\/ca\/692187\/"},"modified":"2026-05-25T07:35:11","modified_gmt":"2026-05-25T07:35:11","slug":"hacker-selling-340-million-onlyfans-user-records-built-from-old-breaches","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/ca\/692187\/","title":{"rendered":"Hacker Selling 340 Million OnlyFans User Records Built From Old Breaches"},"content":{"rendered":"

A threat actor is advertising what they describe as a massive database containing information linked to hundreds of millions of OnlyFans<\/a> users, including creators and subscribers. However, conversations with the seller and a review of sample data suggest that the collection did not result from a direct breach or scraping of OnlyFans systems.<\/p>\n

The listing appeared earlier this week on a well-known cybercrime forum, where a user operating under the alias \u201cEuphoric_Reply_5727\u201d offered what they described as \u201c340 Million User Records\u201d linked to OnlyFans users. The seller priced the database at 0.313 BTC, roughly $76,000 at the time of writing.<\/p>\n

According to the forum post, the collection allegedly contains data pulled from \u201cinternal OnlyFans databases,\u201d including personal information, account activity metrics, linked social profiles, and payment-related details.<\/p>\n

Threat Actor Denies Hacking OnlyFans<\/p>\n

The seller advertised the database as containing usernames, names, email addresses, phone numbers, follower counts, likes, uploaded content statistics, account types, and linked social media profiles. The claims initially gave the impression of a direct platform breach or scraping incident.<\/p>\n

However, the story changed after Hackread.com contacted the threat actor directly on Telegram. In private messages, the seller clarified they did not hack or breach OnlyFans. Instead, they claimed the database was built using information collected from previous data leaks and public sources, including breached records from platforms such as Twitter<\/a>, Instagram<\/a>, and Spotify<\/a>.<\/p>\n

\u201cWe didn\u2019t breach or hack OnlyFans,\u201d the seller said in a message shared with Hackread.com. \u201cWe used existing breaches and leaks databases and matched with users of the OnlyFans platform.\u201d<\/p>\n

\"Hacker<\/a>Screenshot shared by the threat actor shows 35GB of data (Image credit: Hackread.com)<\/p>\n

Sample Data Offers More Context<\/p>\n

After speaking with the seller, Hackread.com reviewed sample records shared from the database. The data appears to be organized as a flat text-based collection containing fields such as usernames, email addresses, phone numbers, join dates, follower counts, likes, uploaded content statistics, linked social profiles, and account types.<\/p>\n

Some entries also included a field labelled \u201ccard,\u201d which the seller claimed referred to the last four digits of a payment card linked to an account.<\/p>\n

A closer look at the samples revealed incomplete records, placeholder values such as \u201cNone,\u201d and publicly visible profile metrics. The formatting also differed from how modern consumer platforms typically store production database records internally.<\/p>\n

\"Hacker<\/a>Threat actor\u2019s post (Image credit: Hackread.com)<\/p>\n

Hackread.com independently verified that several usernames and linked details in the sample data matched real OnlyFans accounts. For example, 10 UIDs listed in the shared records matched usernames linked to publicly accessible OnlyFans profiles.<\/p>\n

However, attempts to validate associated email addresses did not produce warnings indicating the emails were already registered on the platform, leaving further verification to OnlyFans itself.<\/p>\n

Payment Card Claims Remain Unverified<\/p>\n

One detail that remains unclear is the seller\u2019s claim regarding payment card data. The listing described the \u201ccard\u201d field as containing the last four digits of a payment card associated with an account. Hackread.com could not independently confirm whether that information is authentic, recycled from older leaks, or included to increase the perceived value of the dataset.<\/p>\n

Nevertheless, the collection still presents privacy and security concerns. Correlating usernames, emails, phone numbers, and social media accounts can expose creators and subscribers to phishing campaigns, blackmail attempts, stalking, impersonation, and targeted harassment.<\/p>\n

The incident also shows a growing underground trend where threat actors combine old breach data<\/a> with publicly accessible information to build searchable identity databases. In many cases, the value comes less from stolen passwords and more from linking online personas to real-world identities.<\/p>\n

At the time of writing, the data was still available for sale. Hackread.com has reached out to OnlyFans for comment.<\/p>\n","protected":false},"excerpt":{"rendered":"A threat actor is advertising what they describe as a massive database containing information linked to hundreds of…\n","protected":false},"author":2,"featured_media":692188,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[45,49,48],"class_list":["post-692187","post","type-post","status-publish","format-standard","has-post-thumbnail","category-business","tag-business","tag-ca","tag-canada"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts\/692187","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/comments?post=692187"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts\/692187\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/media\/692188"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/media?parent=692187"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/categories?post=692187"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/tags?post=692187"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}