Condé Nast Data Breach: 32.8 Million User Records for Sale
Massive data leak exposes personal details of Condé Nast users across major publications.
1The Breach Overview
A database containing 32.8 million Condé Nast user records is being sold for $15,000 on a Russian cybercrime forum. The data includes email addresses, names, postal addresses, gender, dates of birth, and phone numbers. The records were collected between September and late October 2025, with some never appearing publicly before. The breach affects users across Condé Nast's portfolio, including Vogue, The New Yorker, GQ, and WIRED. Condé Nast has not confirmed the breach or commented on the sale.
2Data Composition
The dataset claims to include 32,815,767 unique email addresses. Approximately 31.6% of records contain both first and last names, 22.3% include postal addresses, and 17.5% include gender information. Only 2.9% of records have phone numbers. The data's value lies in its ability to be filtered and combined with other datasets, not in every record being complete. The seller also offers a version excluding WIRED records, which implies a subset of roughly 2.36 million WIRED-specific records.
3Connection to Previous Leak
The new listing is linked to the December 2025 WIRED leak, where 2.36 million records were made public. The seller claims the current dataset includes the full set behind that leak. However, the sample tested by Ransomnews shows higher rates of names and street addresses than the earlier WIRED dataset, suggesting it's not a recycled copy. The demographic distribution also fits a broader collection of Condé Nast titles, including those with predominantly female readerships.
4Verification of Data Authenticity
Ransomnews tested a 5,000-record sample and found it consistent with genuine Condé Nast account data. Field-completion rates matched the seller's claims within 1.2 percentage points. Among records with full names, 61.9% had email addresses matching the name or initials. Basic time and location checks also passed, with 96.4% of U.S. ZIP codes matching the listed state. The data shows typical web-form errors, indicating it's likely authentic rather than fabricated.
5Timeline of the Breach
Account-creation dates in the sample range from February 1999 to October 2025. New-account entries drop sharply from September 2025 onward, suggesting the data extraction occurred over several weeks. This timeline aligns with the earlier WIRED incident, where records dated through September 2025 were leaked in December. The attacker, using the name 'Lovely,' had previously claimed to have stolen over 40 million Condé Nast records.
6Technical Vulnerabilities
SecurityWeek's analysis indicates the breach likely resulted from insecure direct object reference (IDOR) and broken access-control issues. These vulnerabilities allow one user to view or alter another's data without proper authorization. The attacker's technical claims align with these common web application flaws, which are often exploited in large-scale data breaches.
7Potential Misuse of Data
Despite the absence of passwords, the data poses significant risks. Attackers can use it for targeted phishing, fraud, credential-stuffing, or correlating with other leaked datasets. Personalized messages using names, addresses, and publication relationships can make scams appear more credible. For example, fake renewal or billing requests could easily deceive users who subscribed to Condé Nast publications.
8Broader Implications
This breach highlights ongoing cybersecurity challenges in the media industry. The private sale of such datasets, priced at less than one-twentieth of a cent per record, suggests a market for focused attacks rather than public dumps. Organizations must prioritize securing user data, especially as attackers increasingly exploit IDOR and access-control vulnerabilities. Users should remain vigilant against unexpected messages related to subscriptions or account updates.
Original article: Security Affairs — Condé Nast Data Breach: 32.8 Million User Records for Sale