Wait a minute OnlyFans users. There is a news that may add fuel to the fire. A new cybersecurity claim has triggered fresh discussion about a potential data breach involving hundreds of millions of OnlyFans users.
Threat actors say they had sold user data online. OnlyFans has not yet confirmed any hack. A post on a popular data leak forum says approximately 340 million user records belonging to OnlyFans have been listed for sale. The promoter claims the database includes creator and subscriber data.
The supposedly complete file contains data such as usernames, email addresses, join dates, previous followers, likes, content types and quantities, as well as linked social media accounts. In some cases, the forum post also claimed that payment data about users was available, but this has not been corroborated.
How credible is the 340M-record claim?
It is also important to know how credible this information is. Cybersecurity researchers who examined a small sample attached to the post found only 10 example records and they only included limited fields such as user IDs, usernames, emails, and registration details. Some fields, such as phone and account flags, were missing.
At best, from that small sample, it is impossible to confirm whether 340 million records are valid. Still, the fact that it also includes email addresses means email phishing and targeting are concerns.
So, OnlyFans really hacked?
Surprisingly, the seller who claimed they hacked OnlyFans admitted they did not hack OnlyFans directly. The seller apparently told the researchers that the database was generated by using data from old breaches and publicly available information rather than accessing OnlyFans from within.
This could mean the data is actually a "compilation leak," where older breached records from multiple sources are combined rather than a brand new cyberattack specifically on OnlyFans.
Why are experts still concerned?
Though the data may not have come from a fresh data breach, cybersecurity experts say compiled data sets can be harmful, too. Attackers can use email addresses and reused credentials to launch phishing campaigns or account takeovers.
They can also cross-reference older leaks with new data to create detailed digital profiles of people across multiple platforms.
Do OnlyFans users need to be concerned?
OnlyFans has not confirmed a data breach, and the allegations remain unverified. But experts say users should exercise caution, especially if they have used the same passwords or email addresses on multiple platforms. Unless new information surfaces, the alleged breach will remain under wraps but this situation is a reminder that recycled data from older breaches can still pose major online privacy threats.
ALSO READ: Is AI Really More Expensive Than Humans? Microsoft And Uber Say Workers Still Cost Less- Here's Why