Loading story…
The white supremacist dating website WhiteDate suffered a significant data breach in December 2025, resulting in the exposure of over 6,000 unique email addresses and extensive personal information, including physical attributes, income, education, IQ, and more. The breach has been classified as sensitive due to the nature of the data and the potential for adverse impact on affected individuals. Users are advised to check if their information was compromised and to take appropriate security measures, such as using strong, unique passwords.
A self-identified security researcher, Martha Root, claimed responsibility for infiltrating WhiteDate and two related platforms, WhiteChild and WhiteDeal, extracting over 8,000 user profiles and approximately 100 GB of data. The data was published on a site called okstupid.lol and archived by DDoSecrets, making it accessible to the public. The operation involved the use of a custom AI chatbot to automate data collection and social engineering, and the leak included sensitive details such as profile photos, internal communications, and metadata with GPS coordinates. The incident was discussed at the 39th Chaos Communication Congress, highlighting the risks of data reuse and the potential for cross-referencing with other leaks.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
A larger post-breach dataset was later provided to Have I Been Pwned, expanding the known exposure from about 6,100 to 20,000 unique email addresses. Because of the highly sensitive nature of the data, HIBP classified the breach as sensitive and did not make it publicly searchable.
Following the breach, stolen data from WhiteDate and associated platforms was published on okstupid.lol and archived by DDoSecrets. Reports said the leak exposed thousands of user profiles and the affected sites later went offline, with no formal response from the operators.
At the 39th Chaos Communication Congress in Hamburg in December 2025, pseudonymous researcher Martha Root disclosed details of her infiltration of WhiteDate and related platforms WhiteChild and WhiteDeal. She described using a custom AI chatbot to automate data gathering and highlighted weak security on the sites' WordPress infrastructure.
In December 2025, the white supremacist dating site WhiteDate was breached, exposing user data. Compromised information included email addresses, profile details, IP addresses, private messages, and phpBB password hashes.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
An exposed Firebase database compromised two niche dating platforms operated by the same organization, leaking sensitive user data from **Senior Dating** and **ladies.com**. The Senior Dating breach affected about **766,000 users**, while ladies.com affected roughly **119,000 users**. Exposed records included email addresses, photos, gender, dates of birth, and precise geolocation data; the ladies.com breach also exposed **sexual orientation**, and Senior Dating records included **Facebook account links**. The operator acknowledged the incidents in December 2024 and shut down both services, with ladies.com going offline in mid-2024 and Senior Dating later discontinued alongside it. Both breaches were listed by Have I Been Pwned as **sensitive**, meaning they are not publicly searchable, reflecting the highly personal nature of the exposed information and the risk posed by the disclosure of intimate profile details and exact latitude and longitude coordinates.
Jun 29, 2026
DC Health Link and Doxbin were added as sensitive breach incidents after large datasets containing personal information were exposed online. DC Health Link disclosed a breach discovered in March 2023 after data was reportedly posted to a well-known breach forum, exposing about **48,000 unique email addresses** alongside names, genders, dates of birth, home addresses, phone numbers, and **Social Security numbers**; the posting was linked in reporting to **`IntelBroker`**. Doxbin, a doxing website, was also listed for a breach affecting more than **370,000 unique email addresses** after data from January 2022 leaked. The exposed records included account details such as usernames, password hashes, and browser user agents, as well as highly sensitive victim information contained in doxes, including names, physical addresses, and phone numbers. Both incidents were classified as **sensitive**, meaning the compromised data is not publicly searchable through the breach-notification service.
Jun 29, 2026
A major data breach has exposed the entire user database of BreachForums, a prominent English-language hacking forum on the dark web. The breach was announced on the shinyhunte[.]rs platform, which published a message and made the leaked database available for download and analysis. BreachForums, which had previously replaced RaidForums after its seizure, has been a central hub for cybercriminal activity, including the distribution of stolen data and hacking tools. The forum has faced multiple shutdowns and seizures, but continued to operate under new management and through various hosting providers and domains. In addition to the BreachForums breach, recent activity on dark web forums has included the sale and sharing of data from a South Korean university and a Saudi Arabian employment platform. These incidents highlight the ongoing risks posed by data leaks and breaches on dark web marketplaces, where sensitive information is traded and discussed. Security researchers have made related indicators of compromise (IOCs) and analysis available to subscribers, emphasizing the need for vigilance among organizations whose data may be exposed in such forums.
Jun 29, 2026