340M OnlyFans records listed for sale, seller denies hack

A threat actor is advertising a database of 340 million user records allegedly linked to OnlyFans on a cybercrime forum, but the seller has privately admitted the data was not obtained through a hack of the platform. The listing, priced at 0.313 Bitcoin, roughly $76,000, went viral on social media over the weekend, prompting widespread concern among the platform’s users.

The seller, operating under the alias Euphoric_Reply_5727, posted the database on a well-known data leak forum, claiming it contained usernames, names, email addresses, phone numbers, follower counts, uploaded content statistics, and linked social media profiles. The listing also included a field labeled “card,” described as the last four digits of a payment card associated with each account. The framing of the post initially suggested a direct breach of OnlyFans’ internal systems.

However, after cybersecurity news site Hackread contacted the seller directly on Telegram, the narrative shifted. In private messages, the seller stated, “We didn’t breach or hack OnlyFans. We used existing breaches and leaks databases and matched with users of the OnlyFans platform.” The seller cited previously compromised data from...