India
Social Crypto Platform
User Contact Data
Free Leak
Unverified
Defy Club Data Leak Claim Exposes 23,149 User Accounts With 23K+ Phone Numbers and 9K+ Emails
Overview
An actor using the handle "GoreTerminal" claims to have leaked a Defy Club dataset containing approximately 23,149 user accounts. The post describes DEFY.club as an India-based social crypto platform that lets users share and track portfolios, follow other investors and discuss cryptocurrency.
The actor says the breach occurred on October 30, 2026 at 1:33 PM EDT and characterizes the release as a leak rather than a ransom event. The post highlights 23K+ phone numbers and 9K+ email addresses. The archive is described as JSON Lines, with an uncompressed file named DEFYCLUB_UNIQUE.JSONL at 6.4 MB and a compressed archive at 805 KB. The dataset, its source, the stated counts and current availability have not been independently verified.
Post details
IndiaWhat the post claims
- Approximately 23,149 user accounts
- 23K+ phone numbers
- 9K+ email addresses
- JSON Lines format
- 6.4 MB uncompressed file
- 805 KB compressed archive
- Country field included
- Email field included
- Phone and international-phone fields included
- Mobile-carrier field included
- Internet-protocol address field included
- User and account identifiers included
- Platform / device fields included
- Build and previous-version fields included
- Registration-region fields included
- Profile-created timestamp included
- Source / status fields included
- Sample records displayed
- Free download advertised
The visible sample contains structured user-account records including contact, carrier, device and network-related metadata. Individual phone numbers, email addresses, IP addresses and user identifiers shown in the sample are not transcribed in this report.
Screenshots
IOCs & identifiers
Identifiers directly visible or supported by the supplied material. These support correlation and do not independently verify the breach claim.
| Type | Identifier | Source |
|---|---|---|
| Actor handle | GoreTerminal | Screenshots 1–2 |
| Named organization domain | defy[.]club | Screenshots 1–2 |
The organization domain identifies the entity named in the claim, not malicious infrastructure. No malware hash, Tox ID, Session ID, Telegram handle or attacker-controlled infrastructure is visible in the supplied screenshots. Personal identifiers shown in the sample are not included in this table.
Mapped techniques
Claimed identifies behavior explicitly described by the actor. Inferred identifies an analytical mapping supported by the supplied material. Neither label means the activity has been independently verified.
- Collection T1213.006 Data from Information Repositories: Databases Inferred The listing presents a structured JSONL user dataset containing account, contact, carrier, device and network-related fields. The supplied material does not disclose how the data was obtained or independently establish unauthorized access to Defy Club systems.
Potential impact
If authentic, the claimed dataset could expose phone numbers, email addresses, IP addresses, mobile-carrier information, device/platform details and account identifiers for more than 23,000 users. The combination could support targeted phishing, SMS abuse, account impersonation, profiling or other privacy-related abuse.
Status Unverified
Dark Web Informer has not independently verified the dataset's authenticity, source, completeness, approximately 23,149-account count, phone or email totals, archive sizes, sample contents or the actor's claimed October 30 breach time. The supplied screenshots document the listing and visible sample records, not independent confirmation of the underlying data.
