NewAI pentesting that proves every finding
INSECUREWEB

Data Breach News2 min read

5,700 Subscrip­tions Leaked from German FarRight Platform Nius.de

By InsecureWeb Team

This report reflects observations of dark web activity. InsecureWeb makes no representations regarding the accuracy of this data.

5,700 Subscrip­tions Leaked from German FarRight Platform Nius.de

🔒 Data Breach Summary

On July 12, 2025, forum user “fuckreichelt” on darkforums.st shared a JSON dump containing approximately 5,700 records from nius.de, a German far-right populist news platform. The compromised data includes:

  • Full names
  • Email addresses
  • Subscription types (free, trial, paid)
  • Payment status
  • Masked card data and payment provider info
  • Subscription IDs
  • Technical metadata from the CMS (Squidex) and API structure

📍 Where & How

The leak was posted as a raw JSON dump by “fuckreichelt” on a prominent dark web forum. The inclusion of CMS and API-specific metadata suggests the data was extracted directly from the platform’s backend systems, possibly via a misconfigured API endpoint or vulnerable cloud resource.

⚠️ Risks & Implications

The leaked information poses several threats:

  • Email spam or phishing campaigns, potentially targeting subscribers with malicious content.
  • Profiling of users, especially paid individuals, allowing ideologically motivated attackers to identify participants.
  • Infrastructure exposure, as CMS data can hint at backend vulnerabilities or software versions in use.

🧾 Breach Context & History

While nius.de appears newly targeted, broader German media outlets and platforms have experienced security incidents—though none connected to this site or this kind of leak. No mainstream news coverage about this event was found during the investigation.

This leak highlights specific risks tied to politically sensitive or niche media services and underscores the need for secure API and server configurations.

✅ Recommended Mitigation Measures

For the platform (nius.de):

  • Conduct a full-security audit of backend APIs, CMS, and cloud configurations.
  • Immediately revoke and rotate API keys or tokens.
  • Notify subscribers regarding the breach and provide clear instructions on phishing awareness.

For affected users:

  • Be cautious of unexpected emails—verify sender authenticity before interacting.
  • Monitor email inboxes for phishing attempts using this data.
  • Use unique passwords and consider 2FA where possible (if supported by the platform).

What is InsecureWeb?

InsecureWeb is a Dark Web monitoring service that keeps track of recent data breaches and tracks their impact by monitoring the darkest places of the internet.

Our commitment lies in providing top-notch cybersecurity services to our clients. Through continuous monitoring of the dark web and advanced threat detection methodologies, we strive to identify potential breaches promptly, enabling swift response and mitigation efforts. With our state-of-the-art tools and expertise, we prioritize the confidentiality, integrity, and availability of our clients’ data.

More breach reports