Condé Nast Data Breach Exposes 32.8 Million User Records for Sale A database containing 32.8 million Condé Nast user records is being sold for $15,000 on a Russian-language cybercrime forum, following a leak initially tied to the company’s WIRED publication in December 2025. Cybersecurity outlet Ransomnews verified a 5,000-record sample, confirming its authenticity as genuine Condé Nast account data collected between September and October 2025 including 30.5 million records never previously disclosed. The dataset spans users across Condé Nast’s portfolio, including Vogue, The New Yorker, GQ, Glamour, Vanity Fair, and WIRED. While it lacks passwords, payment details, or usernames, it includes email addresses (100% of records), names (31.6%), postal addresses (22.3%), gender (17.5%), dates of birth (12.6%), and phone numbers (2.9%). The seller claims the full dataset underpins the earlier WIRED leak, with a separate version excluding WIRED containing 30.4 million records aligning with the 2.36 million WIRED records released in 2025. Ransomnews’ analysis found the sample structurally distinct from the public WIRED leak, with higher rates of names and addresses, suggesting a broader collection across Condé Nast’s consumer titles. Internal consistency checks such as matching email patterns to names, ZIP code accuracy, and realistic web-form errors supported its legitimacy. Account creation dates range from 1999 to October 2025, with a sharp decline in new entries after September 2025, indicating the breach likely occurred over several weeks that fall. The attack vector appears linked to insecure direct object reference (IDOR) vulnerabilities, where improper access controls allowed unauthorized data extraction. The seller, operating under a low-reputation account with escrow services, is likely targeting a single buyer rather than a public dump. While the absence of passwords limits immediate credential-stuffing risks, the data enables highly targeted phishing, fraud, and scams particularly for subscription-based services, where attackers could craft convincing fake renewal or billing requests using real user details. The incident underscores the evolving economics of data breaches, where attackers may release a small, recognizable subset to validate a larger, private sale balancing public notoriety with monetization. Condé Nast has not publicly confirmed the breach.

Cybersecurity Alert: Hacker Leaks Data of 2.3 Million Wired.com Users, Claims Larger Condé Nast Breach On December 20, 2025, a hacker operating under the alias "Lovely" leaked what they claim is the personal data of over 2.3 million Wired.com users on the newly launched hacking forum Breach Stars. The leaked dataset includes full names, email addresses, user IDs, display names, account creation timestamps, and in some cases, last session dates—though no passwords or payment information were exposed. The data spans accounts created between 2011 and 2022, with some records showing recent activity, suggesting a breach of a live or archived user database. The hacker accused Condé Nast, Wired’s parent company, of neglecting security warnings, stating they had spent a month attempting to alert the company before resorting to the leak. In a provocative message, they threatened to release data from over 40 million additional accounts across Condé Nast’s portfolio in the coming weeks. The leaked breakdown includes records from brands such as GQ (994K), Vogue (1.9M), The New Yorker (6.8M), and Bon Appétit (2M), among others. An entry labeled "NIL" with 9.5 million accounts remains unidentified, while smaller segments suggest the breach may involve centralized account infrastructure. Prior to the leak, the hacker had contacted journalists, including DataBreaches.net, posing as a security researcher before shifting to threats of public exposure. The method of the breach remains undisclosed, though analysis by Hackread.com confirms the legitimacy of the leaked Wired data. Condé Nast has yet to issue a public statement confirming or denying the incident. Until an official response is provided, the claims and leaked data remain unverified.

Condé Nast notified about 1,100 WIRED subscribers of a breach involving their payment information. They stated that an unauthorized party accessed their vendor’s systems in an attempt to acquire information. The compromised information includes names, postal and email addresses, credit/debit card numbers, security codes, and card expiration dates.