A massive dataset of 340 million OnlyFans profiles has been compiled by a threat actor, not through a direct breach of the platform, but by aggregating data from previous leaks and publicly available information. This collection, being sold on a cybercrime forum, is likely the result of correlating old breach data with public profile information, rather than a new, sophisticated attack on OnlyFans. The threat actor's approach highlights the lingering risks of past breaches, as sensitive information can be repurposed and recombined to create new, potentially damaging datasets. The availability of this dataset poses a significant risk to the individuals whose information is included, as it can be used for various malicious purposes, such as phishing or extortion. This incident matters to security practitioners because it underscores the importance of monitoring and responding to breach data, even after the initial incident has passed1.