- A threat actor claims to have stolen more than 150 million Notion user records, including email addresses and hashed passwords, but no evidence confirms a breach of the company’s systems.
- The account of the seller shows suspicious patterns, and forum administrators have flagged the user as fraudulent.
- If authentic, the dataset could enable all sorts of criminal activities due to the inclusion of password hashes and account metadata.
Recently, a hacker put up an advertisement on an underground website, claiming to be in possession of over 150 million records of Notion users. The advertised data allegedly includes email addresses and hashed passwords.
The dataset supposedly features registration dates and account activity timestamps. Signup and last-login IP addresses are reportedly included as well. The information also contains locale, timezone, country details, and workspace-related metadata.
No Evidence that Notion Itself Suffered a Breach
The forum post contains no evidence linking the data to the systems of Notion. The provenance of the records remains entirely unclear. The seller may have compiled the information from multiple sources. Threat actors often combine data from previous breaches. They also use OSINT and data enrichment services.
Security analysts warn against treating this as a confirmed breach. The source of the records must be independently established. Organizations should avoid making security decisions based on unverified claims.
There has been no confirmation of any intrusion from Notion. The security team of the company studied the allegations in detail and found no truth in the claims.
The dark web listing provides no technical proof of the breach. The seller offers only a small sample of the alleged dataset. This sample does not demonstrate how the data was obtained. The absence of technical evidence is a major concern. Legitimate breach sellers typically provide more proof. This listing lacks such supporting documentation.
Signs the Seller may not be Trustworthy
The user account on the forum is from July three years ago – it has the VIP designation with 41 posts and a reputation score of 17. These statistics provide some thin-layer credibility to the ad post. However, they do not prove the data is genuine. Experienced forum users can achieve status through other means.
The low asking price of $500 for the Notion data follows a pattern seen in other dubious listings. Dark web analysts report that corporate network access and alleged user databases are now being advertised for as little as $500, often turning out to be fabricated claims or old, recycled data rather than fresh compromises.
The forum user appears to have a pattern of making large breach claims. Other companies have denied similar allegations from this source.
Also, the asking price is unusually low for the claimed data volume. This fact raises certain red flags about the authenticity of the listing. The management of some forums have marked the user as a fraud. They took down the post on one forum. They also banned the user on another platform.
Some community members have questioned the claims of the seller. The sample data may have been scraped from public sources. It could have been taken from previous unrelated breaches. Data aggregation is a known practice in underground markets. Threat actors often repackage old data as new breaches. This makes the information appear more valuable than it actually is.
Notion has a strong security track record. The company has no publicly reported security breaches. In addition, the organization has well-established defense mechanisms in place, including AES-256 encryption and TLS 1.2 protocols along with multi-factor authentication measures that protect employee accounts. The company also conducts daily backups of all data; it has a 24/7 incident response team that monitors for threats.
Potential Risks If the Dataset is Authentic
The inclusion of hashed passwords presents serious security risks. Attackers could attempt to crack these hashes using powerful tools. Success depends on the algorithm used and password strength. They could recover weak passwords quickly using brute force attacks. Strong passwords would take much longer to crack.
Recovered passwords could be tested against other online services. Many users reuse passwords across multiple platforms. This habit increases the risk of credential stuffing attacks. Attackers could access email accounts, bank apps, or work systems. The damage could extend far beyond Notion itself.
Exposed email addresses also enable targeted phishing campaigns. Attackers could impersonate Notion support or other trusted services. They could combine this data with information from other breaches. This creates more convincing social engineering attacks. Victims are more likely to fall for personalized messages.
Account takeovers represent another serious concern. The account metadata provides valuable context for attackers. Registration dates and IP addresses help build user profiles. Workspace information reveals internal team structures and roles. This knowledge helps attackers plan more effective intrusions.
The dataset could enable targeted attacks on specific organizations. Workspace metadata shows how companies use Notion internally. This reveals sensitive operational details and workflows. Attackers could exploit this knowledge for espionage purposes. The potential impact remains significant even without confirmed source attribution.
Official Response and Next Steps
Notion addressed the claims in a public statement, indicating that it found no evidence of a breach. Notion confirmed it is monitoring the situation closely. The security team will keep the community updated if needed. The company recommends users follow standard security practices.
Aside from that, customers should reset their passwords. They should set up multi-factor authentication on their accounts. They must also pay attention to dubious emails with claims from Notion. Customers must keep track of transactions on their accounts for any unauthorized use. Reporting any unusual behavior to the security team of the company is advisable.
The dark web listing remains unverified at this time. Security experts advise treating it with skepticism. The data could come from an unrelated source. It could also be completely untrue and an attempt to make some profit. Until there is trustworthy proof, it is safer to be careful.
