2026 Enfit.net — 34.5M user database sale claim (unverified)
Data compromised
Actor-claimed: user IDs, usernames, emails, password hashes, phone numbers, postal addresses, profile photos, birth dates, login IPs, password-reset tokens, device/push tokens, social links — unverified
Technical writeup
Unverified dark-web sale claim — observed July 4, 2026 per DailyDarkWeb monitoring. A threat actor advertised the alleged sale of a user database belonging to South Korean fitness platform enfit.net, claiming more than 34.5 million user records including usernames, emails, password hashes, phone numbers, addresses, profile photos, device identifiers, and account-recovery tokens. DailyDarkWeb noted authenticity was not independently verified at posting time. Enfit had not issued a matching public breach confirmation in sources reviewed. BreachHistory indexes the actor marketing count (34,500,000) as unverified.
Root cause
Unverified underground forum sale claim for enfit.net user database — actor listing ~34.5M records; Enfit had not confirmed at indexing time