- A dark web threat actor is allegedly selling the complete user database and source code of Champhunt, India’s reward-based cricket social media platform.
- The breach reportedly exposes the personal details, hashed passwords, phone numbers, and location data of over 224,000 registered users.
- The seller is demanding a one-time payment in Monero (XMR), the privacy-focused cryptocurrency favored by cybercriminals for its untraceable transactions.
A cricket social platform built for fans just became a hunting ground for hackers. A threat actor on the dark web is allegedly selling the entire user database and proprietary source code of Champhunt, a reward-based social media platform built exclusively for cricket enthusiasts in India and beyond. Dark web monitoring services flagged the alleged breach on April 20, 2026, and the scope of what is reportedly on sale is deeply alarming.
The listing claims to include 224,300 unique user records. Names, email addresses, mobile numbers, dates of birth, gender, state and country location data, profile photographs, and user-written “About Me” descriptions are all reportedly part of the exposed dataset. The seller has also listed hashed passwords among the compromised fields, raising the immediate risk of credential-cracking attacks if those hashes turn out to be weakly protected.
The dataset does not stop at personal identifiers. It reportedly contains platform-specific engagement data including follower counts, total and received “Runs” (Champhunt’s in-app reward currency), and account creation and last modification dates. That behavioral metadata gives any potential attacker a detailed picture not just of who these users are, but how actively they use the platform.
Threat Actor Puts Champhunt’s Source Code Up for Sale
The most alarming detail in this alleged breach is not the user data. It is the source code. When a platform’s source code lands in malicious hands, the fallout reaches far beyond the immediate data loss.
Attackers who gain access to a codebase can reverse-engineer its security architecture, identify unpatched vulnerabilities, and launch further attacks against both the platform and its users, even long after the company addresses the original breach. The sale of Champhunt’s source code essentially hands criminals a blueprint of the platform’s inner workings.
The actor’s choice of Monero as payment is equally telling. Unlike Bitcoin, Monero transactions are designed to be completely untraceable, making it the preferred currency on dark web marketplaces where anonymity is everything. Its use here points to a calculated, deliberate operation rather than an opportunistic one.
Champhunt has not issued any public statement at the time of publication. The full scope of the breach also remains pending independent verification.
India’s Digital Sports Community Faces a Growing Threat
Champhunt bills itself as India’s premier cricket social network, a space where fans connect, discuss live matches, share opinions, and earn “Runs” redeemable for real rewards. The platform previously signed West Indies cricketers Shai Hope and Kieran Powell as brand ambassadors, signaling its ambitions to expand beyond India into the broader cricket-following world. That international reach means the breach could affect users across multiple countries, not just India.
The incident lands against a troubling backdrop for Indian digital platforms. Indian organizations faced an average of over 2,000 cyberattacks per week in 2025, according to cybersecurity researchers, a figure significantly above the global average. Data-rich consumer platforms like Champhunt represent a particularly attractive target for threat actors looking to monetize stolen information quickly.
The use of dark web marketplaces to sell stolen user databases has accelerated sharply in recent years, with cybercriminal groups increasingly targeting niche platforms that hold dense personal data but may lack the security resources of larger corporations. For Champhunt’s users, the message is urgent and clear.
Security experts strongly advise all affected users to change their passwords immediately, activate two-factor authentication where the option is available, and stay alert to phishing attempts that exploit their now-exposed personal details. In a breach of this nature, acting fast is the only real defense available while the platform itself works to contain the damage.
The Lockheed Martin breach claim, whether verified or not, serves as a reminder that no organization, from a cricket social media startup to a multi-billion dollar defense contractor, is immune to the threat of data theft and dark web sales.
