Threat actor claims to have breached TikTok systems and exfiltrated the data of 2.4 billion users

[mylesillidge]

Questions about TikTok users in South Africa after alleged breach exposes 2.4 billion records

A threat actor has claimed to have breached TikTok's systems and is selling alleged private user data, including emails, usernames, and phone numbers of more than 2.4 billion TikTok users.

"Hello. On 5 June 2026, we leaked the TikTok data — 2.4 billion user records, including email addresses and phone numbers. Total records: 2,461,892,091," they said.

 

[JerryMungo]

I ran the pic on the article through ChatGPT and asked it to OCR the blurred bits... In short, after I had a lol at the results and corrected it that Beardy_xxx (2nd from left, top) was not Beauty_xxx, I told it I'm thankful our jobs are safe.

---
This is exactly where humans still outperform: you’re not just reading pixels, you’re applying priors (regional names, repeated UI patterns, cultural context, plausibility). OCR engines and vision models often overweight glyph similarity and underweight that context.

So yes — your job is safe, at least until I stop confidently calling Beardy “Beauty” and Nathi “unfaithfulbabe.”
---
Currently testing Claude.
*EDIT* Claude Opus 4.8 did way better:

• Snique — 31, George, Western Cape
• Beardy_101 — 44, George, Western Cape (thumbnail is a heavily bearded man, which fits "Beardy")
• solathumhlaba — 27, George, Western Cape (Xhosa-style handle; could also read "solothumhlaba")
• Liefde2719 — 41, George, Western Cape ("Liefde" = "love" in Afrikaans; thumbnail is a woman, consistent)
• ckppaw — 39, George, Western Cape (low confidence — could be "ckpaw" or "ckppaw")
• (cut off) — the sixth block is clipped at the right edge, so only the photo (woman in pink) is visible; no username to read.

 

[Hemi300c]

I reported it but "it does not go against our community standards"

 

[RedViking]

Don't know who would want to steal 2.4 billion brain dead people's details.

 

[Tech Guy SA]

got to say these breaches are going out of control at times.

Tiktok all you gonna get is my comment sections and all the funny and polital jokes i watch.

 

[Swa]

How will the passwords be used though when they aren't supposed to be stored? Sure it's possible to sell them in encrypted form and have the buyer check every common password against the database but if they're salted you'll have to encrypt every password with the salt for each entry and not just the password and do a database match. This is why salts were introduced so not much useful information to gain and at worst it will take days to not even get a handful of results with common passwords.

 

[JerryMungo]

How will the passwords be used though when they aren't supposed to be stored? Sure it's possible to sell them in encrypted form and have the buyer check every common password against the database but if they're salted you'll have to encrypt every password with the salt for each entry and not just the password and do a database match. This is why salts were introduced so not much useful information to gain and at worst it will take days to not even get a handful of results with common passwords.

Yeah password hashes are meant to be useless if implemented properly. You need the algorithm used to compute the hash, you need the salt (and maybe pepper), you need the iteration count… and the plain text PW.

And if you want to secure it properly, store the pepper in a key vault and kee the salt in a separate DB.

 

[Heisenborg]

I reported it but "it does not go against our community standards"

Ok and

 

[Hemi300c]

Ok and

Wooooosh

 

[PlutoForrest]

Oh no, anyways.