Urgent tiktok warning as hacker claims to sell data of 428m users on dark web

TIKTOK IS FACING A POSSIBLE MAJOR BREACH AS A THREAT ACTOR CLAIMS TO HAVE PUT MILLIONS OF USERS' INFORMATION UP FOR SALE. 16:09, 03 Jun 2025 A cyber attacker has claimed that they are

in possession of 428 million TikTok user records, which they have put up for sale on a database trading forum on the dark web. The newly emerged threat actor, who goes by alias Often9,

published a post on the forum entitled "TikTok 2025 Breach- 428M Unique Lines" on May 29. The hacker has promised potential buyers extensive information on the millions of

compromised accounts, including phone numbers, email addresses, usernames, and profile links. This information is not readily available on TikTok for users to access about other accounts,

claimed the hacker, who says they retrieved this information through a 'vulnerability' in the server. Hack Read reported that Often9 said on the forum: "Normally, TikTok

doesn’t provide any public API to access private data like emails or phone numbers. But a while ago, due to a vulnerability in one of their internal APIs, it was possible to extract this

data. We discovered and abused that API before it was patched, which allowed us to collect this dataset." The threat actor claims to have breached TikTok's database, rather than

'scrape' together a collection of information that was already publicly available. They said "In short: it’s scraped via API, but because it leveraged a flaw to access data

that wasn’t meant to be public. It’s a breach.” But TikTok has denied the claimed breach, according to Security Boulevard, stating that the data samples are in fact publicly accessible

information and are not the result of a compromise. Article continues below The cybercrime forum used by Often9 has a recent history of fake breach claims, including an incident just last

week where a user falsely claimed to be selling the information of “1.2 billion Facebook users". A TikTok spokesperson said that their security team found no evidence of a breach

related to their systems. They also said that the company uses security safeguards that prevent unauthorised data scraping. But how can you protect your user information from potential

hackers? While a breach into a company that stores user information such as TikTok is out of our hands, there are some things we can do to make our accounts more secure. The US Federal Trade

Commission offers some general tips for keeping your information safe from cyber attackers. Here is their advice. HOW TO PROTECT YOUR INFORMATION FROM HACKERS KEEP YOUR SOFTWARE UP TO DATE

Criminals look for weak points to exploit before software companies can fix them, so it's wise to update the software programs on your computer, tablet, and mobile phone as soon as an

update is available. SECURE YOUR HOME WI-FI NETWORK Your router is the access point between your devices and the internet, explains the FTC. If malware gets onto any device connected to your

Wi-Fi, it can spread to other devices that are connected to the same network, so it's vital your home Wi-Fi has a strong password. USE STRONG PASSWORDS AND ENABLE TWO-FACTOR

AUTHENTICATION Protect all of your accounts with a strong password that’s hard to guess, and turn on two-factor authentication so that a hacker can't breach your account with a password

alone. If you create your own password, you're advised make it long- at least 15 characters- and to use a combination of uppercase and lowercase letters, numbers, and symbols. Article

continues below Since a long password can be hard to remember, you may find it easier to use a passphrase, which is a series of words separated by spaces. Try not to use the same password or

phrase across different accounts, so that if one does get hacked, your other accounts will be safe. JOIN THE DAILY RECORD WHATSAPP COMMUNITY! Get the latest news sent straight to your

messages by joining our WhatsApp community today. You'll receive daily updates on breaking news as well as the top headlines across Scotland. No one will be able to see who is signed up

and no one can send messages except the Daily Record team. All you have to do is CLICK HERE IF YOU'RE ON MOBILE, select 'Join Community' and you're in! If you're on

a desktop, simply scan the QR code above with your phone and click 'Join Community'. We also treat our community members to special offers, promotions, and adverts from us and our

partners. If you don’t like our community, you can check out any time you like. To leave our community click on the name at the top of your screen and choose 'exit group'. If

you’re curious, you can read our Privacy Notice.