Incident Overview

A threat actor operating under the handle "renn" claims to be selling a user database from Affirm, a US/CA buy-now, pay-later financial service. According to the post on the Exploit forum, the database contains 26,702,116 records with a total size of 1.9GB. The breach date is listed as January 23, 2026. The threat actor notes that some phone numbers may contain placeholders as shown in the sample data.

The listing offers the complete database for $14,000 USD or $700 USD per million records with a minimum purchase of 1 million lines. The seller emphasizes "ONLY SELLING ONCE!" and states that records are updated after any sale. The threat actor provides multiple contact methods.