Condé Nast subscriber database offered for sale (32.8 million records)

On 7 September 2026, a seller on a Russian-language cybercrime forum listed a database said to contain 32,815,767 user records belonging to Condé Nast, the publisher of Vogue, The New Yorker, GQ, Glamour, WIRED and Vanity Fair, with an asking price of $15,000. A 5,000-record sample reviewed by researchers was consistent with genuine Condé Nast account data, with account creation dates running from 1999 to 23 October 2025.

The listing is a much larger version of a dataset that first surfaced in December 2025, when a user calling themselves "Lovely" dumped about 2.36 million WIRED records said to come from the parent company's systems. According to the analysis of the new listing, roughly 30.5 million of the records had not previously circulated. Condé Nast did not publicly confirm the breach or comment on the sale.

What was exposed

Every record contains an email address. Around 31.6% also include first and last names, 22.3% a postal address, 17.5% gender, 12.6% a date of birth and 2.9% a phone number. The dataset reportedly contains no passwords, password hashes, usernames or payment card data.

Why it matters

Although the absence of credentials limits account takeover risk, linking a named reader and home address to specific magazine subscriptions makes highly convincing phishing and mail fraud possible, for example fake renewal notices. The episode also shows how a breach that appears contained after a partial leak can resurface months later at many times its original scale.