A database said to contain 32.8 million Condé Nast user records is being offered for $15,000 on a Russian-language cybercrime forum. Ransomnews reviewed a 5,000-record sample and concluded that it is consistent with genuine Condé Nast account data collected between September and late October 2025, including records that have not appeared publicly before. Ransomnews’ original report provides the underlying analysis.
The alleged dataset covers users across Condé Nast’s publishing portfolio, which includes Vogue, The New Yorker, GQ, Glamour, WIRED, Vanity Fair and other titles. Condé Nast has not publicly confirmed the breach or commented on the new sale listing.
The seller claims the database contains 32,815,767 unique email addresses. It also allegedly includes names, postal addresses, gender, dates of birth and phone numbers for portions of the population, but no passwords, password hashes, usernames or payment-card data.
“A database of 32,815,767 Condé Nast user records went on sale on a Russian-language hacker forum on 7 September 2026 for $15,000, offered as the full set behind December’s WIRED leak.” Ransomnews states. “Ransomnews tested the 5,000-row sample: it is genuine Condé Nast account data, captured in September and October 2025, and the 30.5 million non-WIRED records have not surfaced publicly before. Condé Nast has never commented on the breach.”
Ransomnews found that 31.6% of records allegedly include both first and last names, 22.3% include a postal address, 17.5% include gender, 12.6% include a date of birth and 2.9% include a phone number. The data is valuable because it can be filtered and combined with other information, not because every record contains every field.
The listing claims to include the full dataset behind the December 2025 leak involving WIRED, one of Condé Nast’s best-known publications. The seller says that a separate version excluding WIRED contains 30,455,594 records, which implies a WIRED subset of roughly 2.36 million records.
That figure closely matches the 2,366,576 WIRED records made public in December 2025. SecurityWeek previously reported that the actor behind that leak, using the name “Lovely,” claimed to have stolen more than 40 million Condé Nast records and threatened to release data linked to other publications.
Here’s a simpler and more natural version:
The numbers connect the new listing to the earlier WIRED breach, but they don’t prove that the seller is the original attacker. The seller could be the same person, a partner, or someone who got the data later.
The sample does not look like a recycled copy of the public WIRED leak. It contains names and street addresses at higher rates than the earlier WIRED dataset, has a different field structure and shows a demographic distribution that fits a broader collection of Condé Nast consumer titles, including publications with predominantly female readerships.
Ransomnews did not test the records against live Condé Nast accounts, which would have created further privacy risks. Instead, it used internal consistency checks to determine whether the sample behaved like a real long-running consumer database.
The 5,000-record sample closely matched the seller’s claims, with field-completion rates differing by only 1.2 percentage points. Among records with full names, 61.9% had an email address that matched the name or its initials. When names were randomly mixed between records, that figure fell to just 0.3%.
The data also passed basic time and location checks. None of the 227 records using Apple Relay, iCloud, Outlook, Me.com or Proton addresses appeared to predate those services. Also, 96.4% of U.S. ZIP codes matched the listed state, while 93.5% matched the listed city.
Messy data can be useful evidence. Fields such as “Select your state,” numeric dropdown values, inconsistent country labels, lower-case names and dates of birth set to 1 January are the kind of ordinary web-form errors that accumulate in a database built over decades. Fabricated data is usually cleaner. Real data is often embarrassingly human.
Account-creation dates in the sample run from February 1999 to 23 October 2025. Ransomnews notes that new-account entries thin sharply from September 2025 onward, which suggests the extraction took place over several weeks between September and late October.
That timing fits the earlier incident. The public WIRED leak contained records dated through September 2025, while the person calling themselves Lovely contacted DataBreaches.net in November and the WIRED material appeared online in December.
SecurityWeek’s earlier analysis said the attacker’s technical claims were consistent with insecure direct object reference, or IDOR, and broken access-control issues. In that kind of failure, an application lets one user view or alter another user’s data because it checks identifiers but fails to verify authorisation properly.
The seller’s account is new, has little visible reputation and offers escrow, according to Ransomnews. That profile fits a seller seeking a single buyer rather than public attention, especially when the dataset is priced at less than one-twentieth of a cent per record.
A public dump produces headlines. A private sale can produce a more focused problem: a buyer can use the data for phishing, lead generation, fraud, credential-stuffing preparation or correlation with other leaked datasets without ever publishing the full file.
The absence of passwords does not make the data harmless. A person who subscribed to Vogue, booked a gift subscription for GQ or registered for The New Yorker may receive a message that accurately uses their name, address and publication relationship. That is enough to make a fake renewal, refund or billing request look far more credible than ordinary spam.
Readers should treat unexpected messages about subscription renewals, billing problems, delivery issues, gifts or account verification with caution. Instead of using an email link, open the publisher’s website directly through a known address and check the account there.
A password reset is not the first priority based on this dataset alone, because no passwords or password hashes were found in the sample. However, anyone who reused the same email address across many services should be alert to follow-on phishing and should use a password manager and multi-factor authentication on important accounts.
Postal addresses were present in more than one-fifth of the claimed records. That means fraud may also arrive as physical mail, not only by email or SMS. A letter that references a real magazine title or subscription is not proof that it is genuine.
The more uncomfortable lesson is about breach economics. An attacker can release a small, recognisable subset to demonstrate that the data is real, then hold the larger collection back until a buyer appears. The public sees a leak. The criminal market sees inventory.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, data breach)