Loading threat actor…
Lovely is a threat actor associated with the late-2025 breach and public leakage of subscriber data from Condé Nast properties, most notably WIRED, and with claims of broader access to tens of millions of records across Condé Nast’s shared identity environment. The actor is known to have used the alias Lovely and, in outreach tied to the incident, also posed as a security researcher under the name Dissent Doe. Lovely publicly leaked a large WIRED subscriber dataset and advertised or threatened additional releases affecting other Condé Nast brands including Vogue, Vanity Fair, GQ, and The New Yorker. Reporting consistently attributes the intrusion to exploitation of broken access controls and insecure direct object reference weaknesses in Condé Nast’s centralized account platform, enabling unauthorized retrieval of subscriber profile data at scale. Some accounts also state the exposed weaknesses could permit unauthorized modification of account information. The actor’s activity centered on bulk acquisition and disclosure of personally identifiable information rather than credential theft or payment-card compromise. Exposed records reportedly included subscriber contact and profile data and account metadata. Lovely framed the leak as retaliation for ignored vulnerability reports, but the operational behavior included posting stolen data on criminal forums, offering access to datasets, and threatening further publication of additional records. This places the actor’s conduct in the category of data-theft extortion and public data exposure rather than conventional ransomware deployment. Lovely’s observed tradecraft in this case includes initial access through application-layer security flaws, large-scale data exfiltration, public leaking of victim data, and coercive pressure through threatened future releases. The actor has also demonstrated spoofing or deceptive persona use by presenting as a researcher during attempted disclosure-related communications before proceeding to leak the data.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Leaked a dataset of ~2.3M WIRED subscriber records on underground forums and claimed (unverified) broader access affecting Condé Nast users; leak materials suggest direct access to internal account endpoints rather than scraping.
Lovely is known for leaking and selling large databases of user records from high-profile companies, most recently offering nearly 40 million user records allegedly from Condé Nast subsidiary websites, including Wired.com.
Lovely is conducting extortion and data leak operations against Conde Nast, publishing sensitive subscriber data after the company did not respond to their demands. They threaten to leak more data if their demands are not met.
Lovely is responsible for leaking over 2.3 million WIRED subscriber records and claims to have access to up to 40 million more records from Condé Nast brands. The actor exploited vulnerabilities in Condé Nast's shared identity system, including IDOR and broken access controls, to exfiltrate large amounts of PII. Lovely initially attempted to notify the company of the vulnerabilities but, after receiving no response, leaked the data as a form of protest.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.