OnlyFans came to the fore with the claim that hundreds of millions of user records were put up for sale. While 340 million records were mentioned in the advertisement shared on the cyber crime forum, the platform stated that the data leakage allegations did not reflect the truth. Initial investigations indicate that the data in question may be a data set created by combining old data breaches and public profile information, rather than a new leak taken directly from OnlyFans systems.
What is involved in the OnlyFans data leak claim? In the advertisement shared on the cyber crime forum, it was stated that 340 million user records, allegedly linked to OnlyFans, were put up for sale. Data claimed to belong to both content creators and subscribers were mentioned in the ad. Usernames, e-mail addresses, registration dates, number of followers, number of likes, photo and video statistics, number of publications, linked social media profiles and payment card data were among the topics listed in the ad.
According to the information provided by Cybernews, OnlyFans has more than 4.5 million content producers and nearly 380 million users. OnlyFans rejected the claim. In a statement to Cybernews, the platform spokesperson said that the data leak news was false. In the statement made to Hackread, it was stated that the allegations did not reflect the truth. According to the information, the person who sold the data set said in a private conversation that OnlyFans was not hacked and the platform systems were not infiltrated.
The seller claimed that the data was created through matching from previous data breaches, information leaked from publicly available sources and different platforms such as Twitter, Instagram, Spotify. The fact that the same ad claims that the data comes from the OnlyFans internal database creates a clear contradiction between the sales text and the seller’s private description. It was reported that the account sharing the ad used the nickname Euphoric_Reply_5727 and requested 0.313 BTC for the data set.
This amount corresponds to approximately 3.5 million TL. The posting claimed that the dataset contained personal information associated with content creators and subscribers, account activity metrics, linked social media profiles, and some payment-related fields. The research team examined sample data included in the forum post. It was stated that there were only 10 records in the shared sample, so the claim of 340 million records could not be verified.
Examples included user IDs, usernames, email addresses, and registration profiles. Some fields such as phone number, account flags and linked accounts were found to be empty. He also stated that the examples appear to date back to around August 2025. Other examples also found missing records, placeholder expressions such as None, and public profile metrics. It was noted that the file structure appeared different from records pulled directly from a modern consumer platform’s production database.
Some usernames were confirmed to match public OnlyFans profiles, but email addresses and payment card domains could not be independently verified. The claim on the payment card side also remains unclear. The seller claimed that the card field contained the last four digits of the payment card associated with the account. Although it is not confirmed that the data set was taken directly from OnlyFans systems, combining email addresses, usernames, phone numbers and social media profiles in the same file poses a serious privacy risk.
Such data matches can be used in phishing attacks, account takeover attempts, targeted harassment, blackmail and doxxing attempts. Especially on platforms where the expectation of anonymity is high, the same e-mail address used in different services can lead to people’s online identities being linked together.
Comments
You can write your views about this story. Comments may be moderated according to site settings.