32.8 Million Condé Nast Records Are for Sale. No Passwords Were Taken

Disclosure: Some links on this page are affiliate links. If you purchase through them, we may earn a commission at no extra cost to you. Full affiliate disclosure.

On September 7, 2026, a database of 32,815,767 Condé Nast user records went up for sale on a Russian-language cybercrime forum at $15,000. That works out to roughly half a ten-thousandth of a dollar per record, which tells you something about how this data is meant to be used: not as a trophy, but as raw material for industrial-scale mail and phone campaigns.

Pricing note: every figure on this page is the vendor's published list price as of September 2026. Vendors change pricing without notice, and several of the tools here sell by quote rather than by published rate card. Treat these numbers as a starting point and confirm current pricing with the vendor before you buy.

Condé Nast publishes Vogue, The New Yorker, GQ, Glamour, WIRED and Vanity Fair. If you have ever registered for one of them, or subscribed in print, there is a reasonable chance your email address is in this file.

Here is the part that most coverage will lead with, and the part I want to argue with: there are no passwords in it. No hashes, no usernames, no payment card numbers. The technically accurate summary is "no credentials were exposed," and if you stop reading there you will conclude this is a minor event. It is not, and the reason has nothing to do with passwords.

Editor's Take

The detail worth sitting with is that no passwords were in this file — and that does not make it harmless. Names, emails and phone numbers are exactly the inputs phishing and account-recovery attacks need, and they never expire. Note also the price: at a few ten-thousandths of a dollar per record, this data is cheap enough that buying it is trivial, which is why it will be resold for years.

How We Know the Sample Is Real

Breach listings are advertised constantly and a large fraction of them are recycled, padded, or invented. Ransomnews did the thing that separates a real verification from a retweet: it took the seller's free 5,000-row sample and ran internal consistency tests on it, deliberately without attempting to log into any live Condé Nast account.

The checks are worth understanding, because they are the same ones you should mentally apply to the next breach headline:

• Field completion matched the claims. The sample's fill rates came within 1.2 percentage points of what the seller advertised for the full set.
• Names matched emails — and the control test killed the alternative. Among records with a full name, 61.9% used an email address matching that name or its initials. When Ransomnews randomly shuffled names between records, that figure collapsed to 0.3%. Fabricated or assembled data does not survive that comparison.
• Nothing predated its own email provider. Of the 227 records using Apple Relay, iCloud, Outlook, Me.com or Proton addresses, none had an account creation date earlier than the service existed.
• Geography held up. 96.4% of US ZIP codes matched the listed state, and 93.5% matched the listed city.

My favourite detail is the messiness. The file contains placeholder text like "Select your state," numeric dropdown values where a country name should be, inconsistent country labels, lower-case names, and a pile of birth dates set to 1 January. Generated data is clean. Data that accumulated through decades of web forms is embarrassing, and this file is embarrassing in exactly the right ways.

One honest limit: 32.8 million is the seller's claimed row count, and no one has verified all of it. The sample is genuine; the total is not independently confirmed.

What Is Actually in the File

Every record contains an email address. Beyond that, coverage drops off sharply:

• 31.6% include both first and last name
• 22.3% include a postal address
• 17.5% include gender
• 12.6% include a date of birth
• 2.9% include a phone number

Read those numbers as a filtering problem rather than a completeness problem. A buyer does not need every field on every row. They need the roughly 12.6% of records that carry a date of birth, cross-referenced against the 22.3% with an address, intersected with data from the next breach. Name plus address plus date of birth is enough to attempt synthetic identity construction and to get past knowledge-based authentication at institutions that still rely on it.

And the email addresses alone have immediate value as credential-stuffing fuel. No password came from Condé Nast, but a list of 32.8 million confirmed active consumer inboxes is exactly the input to an automated campaign against every other site those people use.

The WIRED Connection

This listing is not isolated. In December 2025, an actor using the name "Lovely" published 2,366,576 WIRED subscriber records and claimed to have taken more than 40 million Condé Nast records overall.

The new listing offers a version with WIRED removed containing 30,455,594 records. Subtract that from 32,815,767 and you get about 2.36 million — a near-exact match for the WIRED figure released in December. The arithmetic lines up neatly enough to link the two events, though it does not prove the current seller is the original intruder. They could be a partner, or someone who bought the data secondhand.

Ransomnews also found that the new sample is not simply a re-upload of the public WIRED data. It has a different field structure, higher rates of names and street addresses, and a demographic distribution consistent with Condé Nast's broader consumer titles rather than WIRED specifically. Account creation dates run from February 1999 to 23 October 2025, thinning sharply after September, which points to an extraction window between September and late October 2025.

The Company Has Not Said Anything

Condé Nast has not publicly confirmed the breach, commented on the sale, or issued any statement since the December 2025 WIRED leak. Ransomnews says it contacted the company asking whether the flaws "Lovely" described were ever closed, and whether readers outside WIRED were ever notified. There has been no response.

That silence is harder to sustain than it used to be. Vogue and GQ have large European readerships, and GDPR Article 33 requires notifying a supervisory authority within 72 hours of becoming aware of a breach. In the US, California's CCPA/CPRA and the state breach notification patchwork apply to the personal data fields present here. Whether any of that was triggered depends on facts only the company has, which is precisely the problem.

One clarification worth making, because it keeps getting muddled: Ars Technica is owned by Condé Nast but runs on a separate system, and has said it was unaffected.

What to Actually Do

I want to be precise here, because the standard advice for breaches does not all apply.

• Do not panic-reset your passwords. No credentials were in this file. Resetting a Condé Nast password does nothing about this exposure, and the advice to "change all your passwords" after every headline is how people end up reusing worse ones.
• Do treat magazine-branded email with suspicion. The realistic attack is a message about your subscription: a renewal notice, a billing problem, a delivery failure, a gift subscription. The sender knows you subscribe, and if your record carried a name and address, the message will use them. Go to the publisher's site directly instead of clicking.
• Do check stealer logs instead. If you want to know whether your accounts are genuinely at risk, the useful question is whether your email appears in infostealer harvests — that is what actually produces working credentials. Our dark web monitoring comparison covers services that do this.
• Do reduce how much of this is findable. Your name, address and date of birth being purchasable from data brokers is the underlying condition that makes a file like this dangerous. Our guide to data removal services compares what actually gets removed, and our identity theft protection comparison is the broader version if you want monitoring attached.
• If you run a business, brief your staff. Employee records in this file become workplace phishing material. A convincing internal-looking email that references a real magazine subscription is a decent pretext.

For the general sequence after any exposure like this, our data breach response guide walks through triage in order, and our phishing identification guide covers the specific tells in subscription-themed lures.

The Honest Read

"No passwords were stolen" is true and nearly useless. The value of this dataset was never in authentication; it was in confirmation. It confirms 32.8 million people subscribe to specific magazines, and for millions of them it confirms a name, an address and a birth date that can be joined to whatever else is already circulating. Nobody needs to break into anything with this file. They need to send a better email.

We covered the harder version of this problem in the IDScan driver's license breach, where 153 million records included documents that cannot be reissued at all. That was a worse breach by any measure. This one is ordinary, and that is the point: ordinary exposure of ordinary fields, sold for the price of a used car, is enough to keep the phishing pipeline running for years.