Hackers claim to sell 340 million stolen OnlyFans recordings, but experts are already skeptical about the severity of the hack.

The Dark Web listing claims to sell 340 million records of OnlyFans creators and users, including personal information and account activity metrics.
OnlyFans denies the breach and Cybernews’ analysis suggests the dataset is likely a compilation of past leaks and public sources rather than an internal dump.
Even if inauthentic, the exposed emails and metadata could still enable phishing, profiling, spamming, and harassment of creators and users.

A massive database, allegedly containing personally identifiable information (PII) of OnlyFans creators and users, is reportedly being offered for sale on the dark web. However, the authenticity of the data is in question and the manner in which it was obtained does not suggest an actual breach of the company’s servers.

Security researchers from Cybernews reported spotting a new ad on a dark web forum, offering 340 million records pulled from internal OnlyFans databases:

“The listing provides exclusive access to a purported backup of OnlyFans’ internal database containing approximately 350 million user records,” the post states. “The dataset encompasses both fan accounts and created accounts, exposing a wide range of personally identifiable information and detailed metrics of account activity.”

“False reports”

The publication further claims that the archives contain usernames, joining dates, email addresses, number of followers like count, image count, video count, stream count, payment card data information and linked profiles.

Commenting on the news, a company spokesperson said Cybernews “Basically, this information is false.”

The publication’s researchers also analyzed the sample posted on the dark web and said it was disappointing and they were unable to determine whether the archive was authentic or not.

“Based on the sample alone, we cannot confirm the actual size of the data. However, the sample indicates that individuals whose data is exposed could be phishing targets,” the team explained.

“However, emails alone could serve as a sensitive reconnaissance point. Threat actors could use this information to cross-reference information from other adult content sites to build profiles of those exposed.”

The hackers did not say they broke into OnlyFans, but rather compiled information from previous OnlyFans leaks, cross-checking it with public sources, other data breaches, and various publicly available information.

Cybernews suggests that this might be true and concludes that even in this form the archives could be quite dangerous.

“If it is a compilation, the data could be used for reconnaissance and profiling purposes. For example, attackers could investigate whether users’ emails are repeated across multiple websites or whether additional sensitive information has been leaked. Additionally, exposed creators’ contact details could also lead to spam and harassment against them,” the report said. Cybernews » concluded the team.