[Contained][Severity: Critical][Web app exploit][API abuse]

Fancrew: API breach leaks 1.03 million member records, including password hashes

A flaw in its member-data API exposed 1,030,741 records, including password hashes. All functions were suspended and the flaw fixed; former members are excluded.

Disclosed

2026-11-02

Organizations involved

Leaked or at risk

1,030,741

Downtime

Unknown

Timeline and exposed information

Member data was accessed between 10:52 on 30 October and 19:45 on 31 October. Abnormal access was detected around midnight on 1 November, blocked by 01:36, and all functions suspended at 10:43. The 1,030,741 records exclude former members and include IDs, emails, password hashes, names, gender, postal codes and only the last four phone digits. Cleartext passwords and complete phone numbers are not listed. [2]

Response and reopening plan

The vulnerable API was fixed and access controls tightened. No fraudulent logins or point exchanges using the leaked data have been found. The second report plans reopening at 11:00 on 5 November; it does not confirm actual recovery. Submission and point-expiry deadlines are extended to 9 November. This is separate from the August login attack. [2]