428 Million TikTok Records: The Breach the Company Won't Acknowledge

Every data breach has two versions: one from whoever brought it to light, another from whoever it hurts, and they rarely match. In late June 2026, a seller surfaced on the shadow forums under the name Often9, claiming to have stolen 428 million unique TikTok accounts by exploiting a vulnerability in an internal API that, under normal circumstances, should never hand out an email or a phone number to outsiders.

The posted sample contains email addresses, phone numbers, user IDs and nicknames, short bios, links to avatars and profiles, and follower counts. Hackread, which examined the dump, noted that some of the records genuinely rarely appeared in earlier leaks — an argument for its authenticity; but the same dump also turned up empty and plainly generated email and phone fields, which casts doubt on the completeness and provenance of the database. TikTok, for its part, insists on the opposite: the company's security team found no trace of a breach, and the data itself is publicly available profile information reassembled into a single table, not stolen.

The truth probably lies somewhere between the two press releases: too many records to be pure invention, too many empty fields for a clean theft. But even as public information gathered into a single database of 428 million rows, such a set is a gift for phishing and password-guessing, no matter what you call it in court.