A hacker is claiming to sell a massive OnlyFans data leak tied to 340 million user records on a popular cybercrime forum.

The seller, operating under the alias “Euphoric_Reply_5727,” listed the database for 0.313 BTC, which works out to roughly $24,007 at the time of listing.

OnlyFans has publicly called the reports “false,” but the listing remains live and researchers say at least some of the sample records line up with real accounts on the platform.

How the OnlyFans Data Leak Happened

According to the seller’s own post, this is not a direct hack of OnlyFans. The dataset was built by cross-referencing old breach dumps from other platforms with known OnlyFans accounts.

In their words: ‘We didn’t breach or hack OnlyFans. We used existing breaches and leaks databases and matched with users of the OnlyFans platform.’

The seller specifically cited older breaches from Twitter, Instagram, and Spotify as the source material. The exposed fields reportedly include:

• Usernames and full names
• Email addresses and phone numbers
• Follower counts, likes, and content upload stats
• Account types and linked social media profiles
• Claimed last four digits of payment cards

TROYPOINT Tip: Protect your identity and personal info from a data breach by using Aura Identity Theft Protection which is TROYPOINT’s recommended identity theft protection.

Aura Identity Theft Protection Review

Independent researchers reviewed the sample data and confirmed that 10 of the usernames matched real OnlyFans profiles. The email matches and payment card claims could not be independently verified at the time of writing.

OnlyFans’ Response

OnlyFans told reporters the claims are “false” but offered no further detail on the data or the seller’s methodology.

That denial fits the pattern we’ve seen with other “compilation” leaks, where a platform technically wasn’t hacked but its users still end up in a fresh database that ties their real identity to a paid account. The risk to the end user is largely the same either way.

How to Protect Yourself from Data Leaks

Even if OnlyFans itself wasn’t breached, having your email or phone number tied to an OnlyFans account in a sellable database is its own kind of problem. Extortion scams and targeted phishing tend to spike right after lists like this hit the market.

If you have an OnlyFans account, or a Twitter, Instagram, or Spotify account that may have been caught in older breaches, take these steps right away:

• Change your OnlyFans password and any account that shares it
• Turn on two-factor authentication using an authenticator app, not SMS
• Be skeptical of any email or text referencing your OnlyFans activity, follower count, or payment details
• Check Have I Been Pwned to see which past breaches your email shows up in

Final Thoughts from Troy

The seller’s own admission that this 340 million record list was stitched together from old Twitter, Instagram, and Spotify dumps is the part worth sitting with.

Your data does not need to be freshly stolen to be freshly weaponized, and a platform like OnlyFans carries reputational risk that a leaked Spotify account never will.

I’d treat the “false” denial as accurate on a technicality and still act like your info is out there, because for a lot of users, it is.

For more details on this story, refer to the original report from Hackread.

We want to know your thoughts. What do you think about this story? Let us know in the comment section below!

Be sure to stay up-to-date with the latest streaming news, reviews, tips, and more by following the TROYPOINT Advisor with updates weekly.