WIRED

Summary

A hacker using the moniker ‘Lovely’ leaked subscriber records from Wired magazine, making approximately 2.3 million entries available for download on cybercrime forums. The exposed data includes names, email addresses, display names, dates of birth, physical addresses, phone numbers and genders, though email addresses are the only field present in every record while the other details appear for only a small subset of users. Hudson Rock verified the leak’s authenticity by matching the information with credentials previously stolen by info‑stealer malware and noted that the file format suggests the attacker exploited insecure direct object reference and broken access control flaws. After the disclosure, the hacker claimed to have obtained more than 40 million additional records from Condé Nast, threatening to publish them in the coming weeks, and the compromised data has been added to the Have I Been Pwned breach notification service.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

A hacker using the online moniker ‘Lovely’ leaked subscriber data from Wired magazine in late December 2025, posting the information on several cybercrime forums for download. The leaked dataset consisted of approximately 2.3 million records that Hudson Rock confirmed were authentic by cross‑referencing them with subscriber credentials previously compromised by info‑stealer malware. The records contained names, email addresses, display names, dates of birth, physical addresses, phone numbers, and gender information, although only email addresses appeared in every record while the other fields were present for a relatively small subset of users. The most recent entries in the leaked files were dated September 2025, indicating that the data covered subscriptions up to that point. After making the Wired data available, Lovely claimed to have obtained more than 40 million additional records from Condé Nast, Wired’s parent company, and threatened to release those records over the following weeks. Condé Nast’s portfolio includes major publications such as Vogue, Vanity Fair, Glamour, and The New Yorker, and the hacker suggested that the additional data could relate to readers of those other titles.

Hudson Rock’s analysis of the leaked file format led the firm to state that the attacker likely exploited insecure direct object reference (IDOR) flaws and broken access control issues to view and alter the data. The security firm’s verification process involved matching the leaked information against known compromised credentials, thereby confirming the legitimacy of the breach. Following confirmation, the exposed Wired data was added to the Have I Been Pwned (HIBP) breach notification service, allowing individuals to check whether their information appeared in the leak. The addition to HIBP served as a public response action aimed at informing affected users about the exposure of their personal details.

The disclosure of names, email addresses, physical addresses, phone numbers, dates of birth, and gender information increased the risk of identity theft, phishing, and other forms of misuse for the individuals whose data was included. While email addresses were universally present, the limited availability of other personal details meant that the potential impact varied across the affected user base. Lovely’s claim of possessing over 40 million Condé Nast records raised concerns about a broader breach that could affect subscribers of the company’s other magazines, though no further data had been released at the time of the report. The incident highlighted the consequences of inadequate access controls on web applications and underscored the role of third‑party security firms in validating breach claims and facilitating public notification through services like HIBP.

Sources

Sources available to members: 1 source.