OnlyFans mega leak reveals 340M user records, hackers claim

Photo by Jonathan Raa/NurPhoto via Getty Images.

Listen to this article

Threat actors claim they’re selling hundreds of millions of records that supposedly reveal OnlyFans creator and fan records, including their activity metrics and social profiles. If confirmed, the OnlyFans mega leak could reveal members’ true identities. Meanwhile, OnlyFans is calling hacker claims false.

Hackers claim to be selling 340M OnlyFans user records including emails, usernames, and account activity metrics.
The alleged leak could expose real identities of OnlyFans creators and subscribers who value anonymity on the platform.
Attackers reportedly compiled the database from previous OnlyFans leaks, public sources, and other platform data breaches.
Exposed email addresses enable threat actors to cross-reference data from multiple breaches for profiling and phishing attacks.

Key Takeaways by nexos.ai, reviewed by Cybernews staff.

The alleged OnlyFans data leak was posted on a popular data leak forum, where attackers often share stolen details. According to the post, the attackers are selling 340 million records, scraped from internal OnlyFans databases.

“The listing provides exclusive access to an alleged OnlyFans internal database dump containing approximately 350 million user records. The dataset encompasses both fan and created accounts, exposing a broad range of personally identifiable information and detailed account activity metrics,” the attackers claim.

The Cybernews community is talking about this. Be a part of the conversation.

OnlyFans is a massively popular subscription-based platform where many creators sell access to adult content, meaning many of its users would likely not want their identities revealed online. The platform has over 4.5 million creators and close to 380 million users. Privacy concerns surrounding adult platforms have also intensified in recent years as OnlyFans age verification requirements continue expanding across parts of the US, prompting some users to become increasingly cautious about how much personal information they share online.

It's unclear whether OnlyFans investigated hacker claims. The company replied calling reports of a data leak false.

“On background, these reports are false,” OnlyFans spokesperson told Cybernews.

What’s inside the OnlyFans mega leak?

According to the attackers, the alleged data leak includes personal user information, which includes:

Usernames
Join dates
Email addresses
Follower counts
Like counts
Picture counts
Video counts
Stream counts
Payment card data
Linked profiles

While the OnlyFans mega leak was not confirmed at the time of writing, our research team has investigated the data sample attackers added to the data leak forum post. The team found only 10 sample records attached to the post.

The listed data included user IDs, usernames, email addresses, and registration profiles. Other fields in the sample that were empty were for phone numbers, account flags, and linked accounts.

onlyfans data leak claims — OnlyFans mega leak post on a data leak forum. Image by Cybernews.

The team noted that samples in the account appear to come from around August 2025, which could indicate the attacker collected older data.

“Based on the sample alone, we cannot confirm the true size of the data. However, the sample does indicate that individuals whose data is exposed could be targets for phishing,” the team explained.

“However, the emails alone could serve as a sensitive reconnaissance point. Threat actors could use this information to cross-reference info from other adult content sites to profile exposed individuals.”

Old OnlyFans hacked data, new mega leak?

Interestingly, threat actors reportedly deny hacking OnlyFans. According to Hackread, the attackers claim they built the database using data from previous OnlyFans leaks, public sources, and other data breaches.

Cross-referencing information from seemingly unrelated data breaches is precisely why having your data exposed online is dangerous. Users often use a single or a few email addresses for multiple online accounts. In the event of a data breach, one dataset can serve as a reference point to match email addresses and obtain additional data.

Don't miss our latest stories on Google News. Add us as your Preferred Source on Google

For example, users might be more secretive about their personal information when setting up an OnlyFans account and far less so with services like Netflix or Spotify. However, if they used the same email address for both services, threat actors can easily match the two.

“If this is a compilation, the data could be used for reconnaissance and profiling. For example, attackers could research whether user emails repeat across multiple websites or whether any additional sensitive info has been leaked. Also, exposed creators' contact info could also lead to spam and harassment directed towards them,” our researchers explained.