Loading story…
Success Magazine reportedly had a subscriber database containing over 141,000 records advertised or shared on a cybercrime forum, with an unnamed threat actor claiming the data was stolen and leaked. Reporting indicates the exposed dataset includes personally identifiable information (PII) such as full names, physical and email addresses, phone numbers, and subscription-related details; researchers cited analysis of attacker-provided samples as consistent with structured customer records.
The leak claim emerged shortly after Success Magazine disclosed a separate security issue in which its website and email systems were compromised by an unauthorized third party; it remains unclear whether the subscriber-database leak is tied to that compromise or represents a separate incident. If the data is authentic, the exposed PII could enable targeted phishing, social engineering, and fraud against subscribers.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
Have I Been Pwned added the SUCCESS breach, describing a March 2026 incident affecting about 250,000 unique email addresses along with names, IP addresses, phone numbers, and order data including physical addresses and payment method information. The listing also said a limited number of staff bcrypt password hashes were exposed and that SUCCESS systems were abused to send offensive newsletters falsely attributed to contributors.
A threat actor allegedly posted a database belonging to Success Magazine on the "News" cybercrime forum, claiming it contained more than 141,000 subscriber records. The leak was reported as unverified and may or may not be connected to the earlier website and email compromise.
Cybernews researchers said two attacker-provided samples appeared to contain structured customer data, including names, physical and email addresses, phone numbers, and subscription details. Their analysis suggested the alleged leak could expose readers to fraud and social-engineering risks if authentic.
Success Magazine announced that an unauthorized third party had compromised its website and email systems. The statement was made days before reports emerged of a separate or possibly related subscriber database leak.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
haveibeenpwned.com
Open sourceteiss.co.uk
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybersecurity researchers reported a major exposure at **IDMerit**, an AI-driven identity verification provider, after discovering an unsecured, internet-accessible **MongoDB** instance containing **over 3 billion records** (over 1TB). Exposed data reportedly included full names, addresses, dates of birth, national ID numbers, phone numbers, and email addresses; researchers estimated roughly **~1 billion** records contained sensitive data (with duplicates likely inflating the total). The dataset was described as global in scope, affecting individuals across **26 countries**, with large volumes attributed to the **US, Mexico, and the Philippines**, creating downstream risk for **identity fraud, account takeover, phishing, and SIM-swap** activity. Separately, Australian finance technology platform **youX** confirmed an **unauthorized third-party access** incident, after which a hacker claimed theft of data tied to **444,528** Australian borrowers and additional loan-application and identity data (including driver’s licence numbers, addresses, and credit/banking-related information), plus customer/staff details associated with broker organizations. **Substack** also confirmed unauthorized access to **limited user data** (including email addresses, phone numbers, and internal account metadata) that occurred in **October 2025** but was only identified on **Feb. 3, 2026**; Substack stated **passwords and payment card/financial data were not accessed**, but the extended detection gap raised concerns about monitoring and dwell time.
Jun 29, 2026
**Figure Technology Solutions** suffered a data breach in which attackers obtained and later publicly posted customer data. Reporting indicates the exposed dataset (dating back to **January 2026**) included roughly **967,200 accounts** / **900k+ unique email addresses**, along with **names, phone numbers, physical addresses, and dates of birth**. Figure confirmed the incident and attributed initial access to **social engineering**, stating an employee was tricked into providing access and that attackers stole a “limited number of files.” The **ShinyHunters** extortion group claimed responsibility and listed Figure on its leak site, alleging the leak included about **2.5GB** of data tied to loan applicants. The breach’s scale was corroborated by *Have I Been Pwned*’s publication of the incident details, while broader coverage noted Figure had not proactively disclosed the incident publicly at the time of reporting and that additional details (e.g., full scope and notification posture) were still emerging.
Jun 29, 2026
Substack confirmed an incident in which an **unauthorized third party** accessed limited user data, including **email addresses**, **phone numbers**, and other unspecified **internal metadata**. The company said the access occurred in **October 2025** and that **passwords, credit card numbers, and other financial information were not accessed**; CEO Chris Best stated Substack identified evidence of the issue in early February and has since **fixed the underlying problem** and opened an investigation. Public reporting indicates the breach may be connected to data posted on criminal forums: a threat actor allegedly leaked a database on **BreachForums** containing **697,313 records** and claimed the data was obtained via a “noisy” scraping method that was quickly patched. Substack has not disclosed the number of affected users or the precise technical root cause, and both reports note the company advised users to be cautious about **phishing** attempts leveraging the exposed contact details.
Jun 29, 2026