Unverified claim — June 30, 2026: A seller on a cybercrime forum advertised approximately 310 million alleged Temu user records. Cybernews confirmed 99 sample rows look recent, but could not verify the headline count—and Temu denies the data originated from its systems.
What happened
On June 30, 2026, Cybernews reported that an unnamed threat actor listed a database described as containing roughly 310 million Temu user records on an illicit marketplace frequented by cybercriminals. The seller published 99 sample records as proof. Temu reportedly has about 416 million monthly active users, so the claimed figure would represent a large fraction of the platform's active base if true—which is precisely why independent verification matters.
Cybernews researchers examined all 99 published samples. They found account-creation or login timestamps predominantly from 2026, suggesting the samples are relatively fresh rather than an obvious mash-up of older public leaks. However, the outlet emphasized that there is no way to verify the seller's claimed scope of 310 million records from samples alone.
What the samples allegedly contain
According to Cybernews, the sample records include:
- Identity and contact: full names, email addresses, phone numbers, user identifiers
- Authentication: bcrypt password hashes (not plaintext passwords)
- Device metadata: Android and iOS device information, app package names, app version details
- Network and locale: sign-up and last-login IP addresses, locale/language settings, geographic information
- Account metadata: creation and login timestamps, internal account flags
Cybernews researchers said the field structure resembles data from an internal account-management system or a third-party service that handles Temu user accounts—not necessarily a direct dump of Temu's consumer storefront database. That distinction matters for attribution: even if the samples are authentic, the source could be a vendor, integrator, or mislabeled compilation rather than a compromise of Temu's core production environment.
What Temu said
Cybernews contacted Temu. A spokesperson denied the claim in strong terms:
"Temu's security team has conducted a comprehensive investigation into the alleged data breach and can confirm that the claims are categorically false; the data being circulated is not from our systems," the company said.
Temu also cited Mobile Application Security Assessment (MASA) certification, a HackerOne vulnerability program, two-factor authentication, membership in the Anti-Phishing Working Group, and PCI DSS payment-security compliance. Those controls reduce certain attack paths but do not by themselves disprove a third-party or misattributed dataset.
Not the same as other Temu incidents
Readers searching Temu data breach 2026 should separate this forum listing from other tracked events:
- Nigeria NDPC probe (Feb 2026): a regulatory investigation into Temu's processing of Nigerian user data (~12.7M data subjects cited in press coverage)—not this forum sale.
- 2024 BreachForums claim (~87M records): an older, separate marketplace listing Temu also denied; that actor was later banned for misrepresentation per BleepingComputer reporting—distinct from the June 2026 310M advertisement.
Risks if any portion of the data is real
Even with bcrypt hashing, exposed emails, phone numbers, device fingerprints, and IP metadata enable:
- Credential stuffing if weak passwords are cracked offline or reused on other sites
- Phishing and smishing impersonating Temu order, refund, or loyalty messages using real account metadata
- Social engineering referencing plausible device types, locales, or login dates
Action items for Temu shoppers
- Do not download alleged leak archives from criminal forums—possession can be illegal and files may contain malware.
- Enable Temu two-factor authentication and use a unique password not reused elsewhere.
- Be skeptical of messages citing real order details unless verified inside the official Temu app.
- Monitor payment methods linked to Temu checkout for unauthorized charges.
- Wait for official notice from Temu before treating the 310M figure as confirmed fact.
Canonical BreachHistory record
BreachHistory indexes this as an unverified actor claim with the seller-cited 310M count clearly labeled pending attestation: Temu forum 310M claim 2026.