OnlyFans responds to report that viewing habits of 340M users are at risk of being leaked

There could be trouble ahead for OnlyFans, with the paid-for content subscription service supposedly hit by a data megaleak that includes the details of 340 million users and creators. While OnlyFans is the biggest in terms of this kind of service, the fact that it has 377.5 million registered users and 4.6 million content creators on its books means that 340 million is more than a sizeable chunk.

Over the past decade, OnlyFans has made a name for itself, offering an alternative to traditional adult entertainment sites and featuring content from major celebrities such as Iggy Azalea, Denise Richards, and Cardi B, who largely want to maintain their freedom without the worries of traditional Hollywood censorship.

Despite questions about the kind of content being pumped out on OnlyFans, it maintains strict rules on what kind of categories are banned, extending to the likes of age play, extreme violence, and using objects that are likely to cause harm.

Opinions remain divided, with creators clapping back at James Fishback's calls to impose a 'sin tax' on OnlyFans earnings. Still, with Piper Rockelle claiming she's broken the platform's one-day earnings record, some performers are happy to boast about their seemingly gigantic earnings.

As we saw with a supposed Pornhub data leak, potential hacks on X-rated sites are a major cause for cybersecurity concern.

OnlyFans means big business, but part of this involves users being able to keep their anonymity. According to Cybernews, that could be at risk thanks to a post on a popular data leak forum. Here, attackers said they're selling 340 million records that were scraped from internal OnlyFans databases: "The listing provides exclusive access to an alleged OnlyFans internal database dump containing approximately 350 million user records.

“The dataset encompasses both fan and created accounts, exposing a broad range of personally identifiable information and detailed account activity metrics."

The outlet adds that it's unclear whether the claim was investigated, although OnlyFans replied saying: "On background, these reports are false."

Cybernews notes that while the leak wasn't confirmed, its own research team looked into the data sample that was attached to the OP post. They discovered only 10 sample records attached, suggesting that even if the leak is legitimate, it might not be in the millions.

Either way, hackers claim to have access to usernames, join dates, email addresses, follower and like counts, picture and video counts, stream counts, payment card data, and linked profiles.

Cybernews' team added: "Based on the sample alone, we cannot confirm the true size of the data. However, the sample does indicate that individuals whose data is exposed could be targets for phishing.

"However, the emails alone could serve as a sensitive reconnaissance point. Threat actors could use this information to cross-reference info from other adult content sites to profile exposed individuals."

It appears that the data might've been taken from an older database, with Hackread saying the hackers claim it was built from OnlyFans data that was leaked from other breaches and public sources.

As a particular red flag, we're reminded that a single dataset can serve as a reference point to match email addresses to other sites and gain more data.

Cybernews' researchers concluded: “If this is a compilation, the data could be used for reconnaissance and profiling.

“For example, attackers could research whether user emails repeat across multiple websites or whether any additional sensitive info has been leaked. Also, exposed creators' contact info could also lead to spam and harassment directed towards them."

When UNILADTech reached out to OnlyFans, it again said the reports are 'false' without offering any further context.