WIRED Database Breach: Over 2.3 Million Subscriber Records Leaked in Condé Nast Cyberattack

Executive Summary

A threat actor using the alias Lovely has publicly leaked a database containing over 2.3 million subscriber records from WIRED, a publication owned by Condé Nast. The leak, first posted on December 20, 2025, includes sensitive personal information such as email addresses, names, physical addresses, phone numbers, and account activity data. The threat actor claims this is only the initial release, with up to 40 million additional records from other Condé Nast properties potentially at risk. Independent technical analysis by multiple security researchers, including Hudson Rock and InfoStealers, has confirmed the authenticity of the leaked data by cross-referencing it with infostealer malware logs. The breach appears to have resulted from exploitation of web application vulnerabilities, specifically Insecure Direct Object Reference (IDOR) and broken access control, which allowed unauthorized mass access to user records. As of December 28, 2025, Condé Nast has not issued a public statement confirming or denying the breach. The incident highlights significant risks for affected users and the broader media sector, including increased exposure to phishing, doxing, and identity-based attacks. All technical claims in this report are supported by primary sources, with explicit evidence and confidence levels provided.

Technical Information

The WIRED database leak is a significant data security incident involving the unauthorized disclosure of 2,366,576 subscriber records, of which 2,366,574 are unique email addresses. The breach was first made public on December 20, 2025, when the threat actor Lovely posted the data on a hacking forum, offering access for a nominal fee in forum credits. The dataset spans account activity from April 26, 1996, to September 9, 2025, and includes a range of personally identifiable information (PII).

Data Composition and Sensitivity

Each record in the leaked database contains a unique internal user ID and an email address. Optional fields, which are populated in a subset of records, include first and last names, phone numbers, physical addresses, gender, and birthdates. Specifically, approximately 284,196 records (12.01%) include both a first and last name, 194,361 records (8.21%) include a physical address, 67,223 records (2.84%) include a birthday, and 32,438 records (1.37%) include a phone number. A smaller subset of 1,529 records (0.06%) contains a full name, birthday, phone number, address, and gender. The presence of this data, even in partial form, significantly increases the risk of targeted attacks against affected individuals (https://www.bleepingcomputer.com/news/security/hacker-claims-to-leak-wired-database-with-23-million-records/).

No passwords or payment information were found in the leaked dataset, but the exposure of real email addresses, names, and physical addresses is sufficient to enable phishing, doxing, and other forms of identity-based attacks (https://hackread.com/hacker-leak-wired-com-records-conde-nast-breach/).

Attack Vector Analysis

Technical analysis by InfoStealers and Hudson Rock indicates that the breach was likely executed via exploitation of Insecure Direct Object Reference (IDOR) vulnerabilities and broken access control in the web application infrastructure. IDOR vulnerabilities allow attackers to enumerate and access user records by manipulating object identifiers in API or web requests. Broken access control, specifically the lack of password validation on critical account management endpoints, may have enabled the attacker to view and modify user credentials or email addresses across the central identity system (https://www.infostealers.com/article/wired-database-leaked-40-million-record-threat-looms-for-conde-nast/).

These attack methods are mapped to the following MITRE ATT&CK techniques: - T1190: Exploit Public-Facing Application (https://attack.mitre.org/techniques/T1190/) - T1078: Valid Accounts (if attackers used or modified legitimate accounts after gaining access) (https://attack.mitre.org/techniques/T1078/)

The confidence level for IDOR and broken access control as the primary attack vectors is high, based on multiple independent technical analyses and direct statements from the threat actor and researchers.

Data Validation and Evidence Quality

The authenticity of the leaked data has been independently verified by Hudson Rock and InfoStealers using infostealer malware logs, specifically from RedLine and Raccoon malware. By matching compromised credentials from global infostealer infection logs against the records in the leaked database, researchers confirmed a high-confidence overlap, establishing the legitimacy of the dataset without direct interaction with the victim organization (https://www.infostealers.com/article/wired-database-leaked-40-million-record-threat-looms-for-conde-nast/).

The use of infostealer logs for validation is mapped to MITRE ATT&CK technique T1555: Credentials from Password Stores (https://attack.mitre.org/techniques/T1555/), though this was for validation, not for the initial compromise.

Threat Actor Profile and Behavior

The threat actor, Lovely, initially presented themselves as a security researcher attempting responsible disclosure via DataBreaches.net. After receiving no response from Condé Nast, the actor escalated to public shaming and data extortion, ultimately leaking the entire database. The actor has threatened to release up to 40 million additional records from other Condé Nast brands, including The New Yorker, Vogue, Vanity Fair, and others. The actor’s behavior is characterized by public shaming, threats of further leaks, and use of multiple hacking forums for data distribution. There is no evidence of ransomware or destructive malware; the focus is on data exfiltration and public exposure (https://www.bleepingcomputer.com/news/security/hacker-claims-to-leak-wired-database-with-23-million-records/).

Attribution to a specific known advanced persistent threat (APT) or cybercrime group is low, as Lovely does not match any established threat actor profiles in public reporting.

Sector-Specific Targeting

The attack is sector-specific, targeting the media and publishing industry, with a focus on Condé Nast and its portfolio of brands. The breach may involve centralized account infrastructure, as indicated by the inclusion of records from multiple brands and sub-brands, as well as a large, unidentified segment labeled "NIL" containing over 9 million accounts (https://hackread.com/hacker-leak-wired-com-records-conde-nast-breach/).

Technical Summary Table: MITRE ATT&CK Mapping

| Attack Phase | Technique Name | Technique ID | Confidence | Evidence Source | |-------------------|-----------------------------------|--------------|------------|-----------------| | Initial Access | Exploit Public-Facing Application | T1190 | High | All sources | | Collection | Data from Cloud Storage Object | T1530 | Medium | InfoStealers | | Collection | Data from Local System | T1005 | Medium | InfoStealers | | Exfiltration | Exfiltration Over C2 Channel | T1041 | Medium | InfoStealers | | Credential Access | Credentials from Password Stores | T1555 | High | InfoStealers |

Affected Versions & Timeline

The leaked database contains records with timestamps ranging from April 26, 1996, to September 9, 2025, indicating that both legacy and recent subscriber data were exposed. The majority of account creation dates fall between 2011 and 2022, with some records showing last session data as recent as September 2025 (https://hackread.com/hacker-leak-wired-com-records-conde-nast-breach/).

The timeline of the incident is as follows: In late November 2025, the threat actor attempted to contact Condé Nast to report vulnerabilities. After a month of unsuccessful attempts and no response, the actor leaked the WIRED database on December 20, 2025. The leak was subsequently distributed on multiple hacking forums, with further threats to release additional data from other Condé Nast properties (https://www.bleepingcomputer.com/news/security/hacker-claims-to-leak-wired-database-with-23-million-records/).

As of December 28, 2025, Condé Nast has not issued a public statement confirming or denying the breach, and no law enforcement advisories or regulatory filings have been published.

Threat Activity

The threat actor Lovely has demonstrated a pattern of escalating activity, beginning with attempted responsible disclosure and culminating in public data leaks and extortion threats. The actor has publicly accused Condé Nast of ignoring vulnerability reports and has threatened to release up to 40 million additional records from other brands in the coming weeks.

The data was initially offered for sale on a hacking forum for a nominal fee in forum credits, then later distributed more widely. The actor has used multiple forums to maximize exposure and has issued statements shaming Condé Nast for their alleged lack of security response.

Technical analysis suggests the attacker exploited IDOR and broken access control vulnerabilities to scrape user profiles en masse. The breach is notable for its focus on data exfiltration and public exposure, rather than financial extortion or ransomware deployment.

The exposure of physical addresses, phone numbers, and other PII increases the risk of targeted doxing, swatting, and spear phishing attacks against affected individuals. The threat landscape is further complicated by the actor’s claim that a much larger breach affecting up to 40 million records is imminent (https://www.infostealers.com/article/wired-database-leaked-40-million-record-threat-looms-for-conde-nast/).

Mitigation & Workarounds

The following mitigation steps are prioritized by severity:

Critical: All users of WIRED and other Condé Nast properties should immediately change their account passwords and enable multi-factor authentication (MFA) where available. Users should also consider using hardware security keys to protect against session hijacking and credential theft, as recommended by security researchers (https://www.infostealers.com/article/wired-database-leaked-40-million-record-threat-looms-for-conde-nast/).

High: Organizations managing large user databases should conduct immediate security reviews of all public-facing web applications, with a focus on identifying and remediating IDOR and broken access control vulnerabilities. Implementing robust access controls, input validation, and regular penetration testing are essential to prevent similar breaches.

High: Affected organizations should monitor for signs of targeted phishing, doxing, and identity-based attacks against their users. Proactive communication with affected users, including guidance on recognizing phishing attempts and reporting suspicious activity, is recommended.

Medium: Organizations should review and update their vulnerability disclosure and incident response processes to ensure timely engagement with security researchers and rapid remediation of reported vulnerabilities.

Medium: Regulatory compliance teams should prepare for potential scrutiny and reporting obligations, especially if the larger 40 million record leak materializes.

Low: Users should be advised to monitor their email accounts for suspicious activity and consider using email aliasing or masking services to reduce exposure in future breaches.

References

https://www.bleepingcomputer.com/news/security/hacker-claims-to-leak-wired-database-with-23-million-records/

https://hackread.com/hacker-leak-wired-com-records-conde-nast-breach/

https://www.infostealers.com/article/wired-database-leaked-40-million-record-threat-looms-for-conde-nast/

About Rescana

Rescana provides a Third-Party Risk Management (TPRM) platform designed to help organizations identify, assess, and monitor security risks in their digital supply chain. Our platform enables continuous monitoring of vendor security posture, automated risk assessments, and actionable insights to support incident response and regulatory compliance. For questions about this incident or to discuss how our capabilities can support your organization’s risk management strategy, contact us at ops@rescana.com.