[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f2r5oq8ndimhv3":3,"$f12j6sn4ukconc":61},{"success":4,"breach":5},true,{"_id":6,"name":7,"title":8,"slug":9,"domain":10,"breachDate":11,"addedDate":12,"publishedAt":13,"modifiedDate":14,"contentUpdatedAt":14,"source":15,"sourceUrl":16,"sourceUrls":17,"pwnCount":20,"affectedCount":20,"affectedCountStatus":21,"affectedCountLowerBound":13,"affectedCountUnit":22,"hasEnglishDescription":4,"contentLocale":23,"availableLocales":24,"translations":34,"severity":45,"dataClasses":46,"description":52,"seoTitle":53,"seoDescription":54,"logoUrl":55,"isVerified":4,"isSensitive":56,"isSpamList":56,"isMalware":56,"company":57},"6aad25c79873889c224ffe5d","WormGPT AI 2026","WormGPT AI Data Breach","wormgpt-2026","wormgpt.ai","2026-02-09T00:00:00.000Z","2026-09-18T11:51:34.711Z",null,"2026-10-09T21:07:46.393Z","WormGPT AI hacking LLM service subscriber and customer database","https:\u002F\u002Fwormgpt.ai\u002F",[16,18,19],"https:\u002F\u002Fsynscan.net\u002F","https:\u002F\u002Fransomlook.io\u002F",4177,"known","unknown","en",[23,25,26,27,28,29,30,31,32,33],"tr","zh","hi","es","ar","fr","bn","pt","ru",{"en":35,"tr":36,"zh":37,"hi":38,"es":39,"ar":40,"fr":41,"bn":42,"pt":43,"ru":44},{"slug":9},{"slug":9},{"slug":9},{"slug":9},{"slug":9},{"slug":9},{"slug":9},{"slug":9},{"slug":9},{"slug":9},"Low",[47,48,49,50,51],"Email addresses","Customer IDs","Payment records","Subscription details","Account balances","\u003Cp>\u003Cstrong>The 2026 WormGPT AI data breach\u003C\u002Fstrong> occurred on February 9, 2026, when the infrastructure of \u003Cstrong>WormGPT.AI\u003C\u002Fstrong> (\u003Ccode>wormgpt.ai\u003C\u002Fcode>), a widely known uncensored LLM service marketed for cyberattack simulation and malware generation, was compromised and exfiltrated by threat actors.\u003C\u002Fp>\u003Ch2>What information was affected in the WormGPT AI incident?\u003C\u002Fh2>\u003Cp>The leaked JSON dataset (encompassing master email records, Stripe customer IDs, IDOR enumeration logs, and subscription tables) exposes users who subscribed to the service. The breach compromised records for \u003Cstrong>4,177 unique subscribers\u003C\u002Fstrong>, exposing:\u003C\u002Fp>\u003Cul>\u003Cli>\u003Cstrong>Account & Customer Identifiers:\u003C\u002Fstrong> Internal user UUIDs, Stripe customer IDs (cus_), and user profile IDs.\u003C\u002Fli>\u003Cli>\u003Cstrong>Contact Credentials:\u003C\u002Fstrong> Canonical email addresses across major providers (Gmail, Outlook, ProtonMail).\u003C\u002Fli>\u003Cli>\u003Cstrong>Financial & Subscription Details:\u003C\u002Fstrong> Stripe subscription statuses, payment attempt logs, failed checkout records, and investor\u002Fsubscriber tiers.\u003C\u002Fli>\u003Cli>\u003Cstrong>Platform Telemetry:\u003C\u002Fstrong> Email delivery logs, abandoned checkout metadata, and token consumption metrics.\u003C\u002Fli>\u003C\u002Ful>\u003Ch2>How many accounts were affected?\u003C\u002Fh2>\u003Cp>Rigorous RFC canonical parsing and deduplication confirmed \u003Cstrong>4,177 unique valid subscriber email addresses\u003C\u002Fstrong>.\u003C\u002Fp>\u003Ch2>Technical analysis and security risks\u003C\u002Fh2>\u003Cp>The exposure of individuals registered on malicious or offensive AI platforms creates severe deanonymization risks. Security researchers, law enforcement agencies, and rival cybercriminals frequently monitor such leaks for attribution and targeted reconnaissance.\u003C\u002Fp>\u003Ch2>Recommended actions for affected users\u003C\u002Fh2>\u003Cp>Individuals who registered on WormGPT.AI should:\u003C\u002Fp>\u003Cul>\u003Cli>Immediately change passwords for associated email accounts and enforce robust multi-factor authentication (2FA).\u003C\u002Fli>\u003Cli>Ensure credentials used on underground services are never recycled across personal or enterprise infrastructure.\u003C\u002Fli>\u003C\u002Ful>","WormGPT AI Data Breach (4.2 Thousand Reported Records)","WormGPT AI Data Breach. 4.2 thousand records are reported. Reported data: Email addresses, Customer IDs, Payment records. Review the scope, risks, and…","\u002Fuploads\u002Flogo\u002Fwormgpt.webp",false,{"name":58,"sector":59,"country":60,"website":60,"websiteArchiveUrl":60,"websiteStatus":60,"websiteCheckedAt":13},"WormGPT AI","Cybersecurity","",{"success":4,"breaches":62},[63,70,76,83],{"slug":64,"title":65,"companyName":66,"logoUrl":67,"breachDate":68,"affectedCount":13,"affectedCountStatus":69},"lastpass-klue-2026","LastPass 2026 Klue Supply Chain Data Breach","LastPass","\u002Fuploads\u002Flogo\u002Flastpass_com.svg","2026-06-12T00:00:00.000Z","not_disclosed",{"slug":71,"title":72,"companyName":73,"logoUrl":74,"breachDate":75,"affectedCount":13,"affectedCountStatus":69},"trellix-2026","Trellix 2026 Source Code Breach","Trellix","\u002Fuploads\u002Flogo\u002Ftrellix_com.svg","2026-04-18T00:00:00.000Z",{"slug":77,"title":78,"companyName":79,"logoUrl":80,"breachDate":81,"affectedCount":82,"affectedCountStatus":21},"hackerone-navia-2025","HackerOne Navia 2025 Data Breach","HackerOne Inc.","\u002Fuploads\u002Flogo\u002Fhackerone_com.svg","2025-12-22T00:00:00.000Z",287,{"slug":84,"title":85,"companyName":86,"logoUrl":87,"breachDate":88,"affectedCount":89,"affectedCountStatus":21},"medela","Medela Data Breach","Medela","\u002Fuploads\u002Flogo\u002Fmedela.webp","2026-09-07T00:00:00.000Z",423947]