WormGPT AI Data Breach
The 2026 WormGPT AI data breach occurred on February 9, 2026, when the infrastructure of WormGPT.AI (wormgpt.ai), a widely known uncensored LLM service marketed for cyberattack simulation and malware generation, was compromised and exfiltrated by threat actors.
Exposed Data Types
5- Email addresses
- Customer IDs
- Payment records
- Subscription details
- Account balances
About This Breach
What information was affected in the WormGPT AI incident?
The leaked JSON dataset (encompassing master email records, Stripe customer IDs, IDOR enumeration logs, and subscription tables) exposes users who subscribed to the service. The breach compromised records for 4,177 unique subscribers, exposing:
- Account & Customer Identifiers: Internal user UUIDs, Stripe customer IDs (cus_), and user profile IDs.
- Contact Credentials: Canonical email addresses across major providers (Gmail, Outlook, ProtonMail).
- Financial & Subscription Details: Stripe subscription statuses, payment attempt logs, failed checkout records, and investor/subscriber tiers.
- Platform Telemetry: Email delivery logs, abandoned checkout metadata, and token consumption metrics.
How many accounts were affected?
Rigorous RFC canonical parsing and deduplication confirmed 4,177 unique valid subscriber email addresses.
Technical analysis and security risks
The exposure of individuals registered on malicious or offensive AI platforms creates severe deanonymization risks. Security researchers, law enforcement agencies, and rival cybercriminals frequently monitor such leaks for attribution and targeted reconnaissance.
Recommended actions for affected users
Individuals who registered on WormGPT.AI should:
- Immediately change passwords for associated email accounts and enforce robust multi-factor authentication (2FA).
- Ensure credentials used on underground services are never recycled across personal or enterprise infrastructure.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
