The headline sounded like the worst case for every creator: 340 million OnlyFans user records for sale, with emails, phone numbers and payment details. Months later, the picture is a lot less dramatic, but not harmless. We read the reporting so you don’t have to.
What happened
The listing claimed usernames, join dates, email addresses, phone numbers, follower and content counts, linked social profiles and “payment card data”, which in the sample turned out to be at most the last four digits of a card.
Confirmed, and not confirmed
- That OnlyFans’ systems were breached
- That the dataset holds 340 million real people
- That full card numbers or passwords are included
- A dataset was offered for sale on a cybercrime forum
- Some sample usernames match real public accounts
- The seller said it was compiled from older leaks and public data
Researchers also pointed out that the advertised fields don’t fit a simple “scrape”, and some suggested parts of the data may be generated. Either way, the most likely answer is a compilation of older breaches, not a new hack of OnlyFans.
Why creators should still care
A compilation can be just as useful to a scammer as a fresh breach. If your creator email, phone number and linked socials sit in the same row, someone can:
- Send you convincing phishing: “Your OnlyFans payout is on hold, verify your account here.”
- Try your old passwords on your OnlyFans and email (credential stuffing).
- Connect your stage name to your personal accounts, and from there to your real name.
- Use your contact details for spam, harassment or extortion.
What to do now
- 01Turn on two-step verificationOn OnlyFans, and on the email address linked to it. This alone stops most account takeovers.
- 02Use a password you use nowhere elseIf your OnlyFans password was ever used on another site, change it today. A password manager makes this easy.
- 03Check your email on Have I Been Pwnedhaveibeenpwned.com shows which known breaches include your address, and which passwords to retire.
- 04Treat “support” messages as suspectOnlyFans will not ask for your password or a code by DM or email. Log in yourself instead of clicking links.
- 05Keep your creator email separateUse an address that is not linked to your personal social accounts or your legal name.
- 06Review what your profile links toOld linktrees, personal accounts and reused usernames can connect your stage name to you.
- 07Watch your card statementOnly the last four digits were claimed, but it costs nothing to check for anything unusual.
How Lock Leaks can help
We can’t take a dataset off a hacker forum. What we do is remove what ends up public: leaked content, fake accounts using your name, and posts that expose your personal details. Basic and Signature plans include doxing and stalking protection: if your address, phone or real name is posted next to your stage name, we find it and get it removed.
