- A threat actor with the name L3yn claims they have data tied to hundreds of thousands of Wibuku users.
- The sample reportedly contains user IDs and Gmail addresses, but the full dataset is still unverified.
- Wibuku says it collects names, emails, user IDs and device identifiers, making the claim worth watching.
A cybercrime forum actor is claiming to have leaked a database containing information on about 200,000 Wibuku users.
The actor, known as L3yn, reportedly posted a sample of the alleged records. The sample shows user IDs paired with email addresses. The claim also says the wider dataset contains registered account information.
There is no independent confirmation that the database came from Wibuku. The size of the alleged leak also remains unverified. As of the time of the report, there’s no public statement from Wibuku confirming a breach.
What the Alleged Wibuku Leak Contains
The claim centers on basic account data. The sample reportedly includes user IDs and Gmail addresses linked to registered accounts. That may look limited compared with leaks involving passwords or government IDs. Email addresses can still have real value to attackers.
A leaked email can help criminals target users with spam, phishing messages and fake account alerts. If users reused the same email and password elsewhere, the risk can be greater.
The available claim does not show whether passwords, payment details or private messages were leaked. So, unless further evidence appears, we can’t draw any conclusions regarding those details.
A similar unverified breach claim involves Siemens. In September 2026, a threat actor posted data allegedly stolen from the company, but researchers found the sample appeared to contain publicly accessible WordPress data rather than internal records. The data may have come from basic web scraping.
Wibuku’s own privacy policy offers useful context. The company says its app collects names or usernames, email addresses, account photos, and device identifiers. It also says it may collect information through third-party services.
Google Play lists similar categories for the current Wibuku app. Its data safety page says the app may collect names, email addresses, and user IDs. It also lists device or other IDs and app activity. Google Play says data is encrypted in transit and that users can request deletion of their data.
That does not prove the forum sample is genuine. It does show that the types of information named in the claim are consistent with data Wibuku says it handles.
Wibuku has a Large User Base
The alleged 200,000 records are a significant amount of user data, even though it hasn’t been validated independently.
Wibuku is an Indonesian anime streaming app. Its user base comprises fans looking for anime with Indonesian subtitles. Google Play data shows the app boasts over 5 million downloads. Independent app tracking service AppBrain shows the app has garnered approximately 7.3 million total downloads.
But that doesn’t imply that Wibuku has 7.3 million registered users. Downloads can include repeat installs, users who never create accounts, and people who stop using the app. Still, the platform has a sizable audience. A real leak affecting 200,000 accounts would therefore deserve attention from users and security researchers.
There Are Also Recent Signs of User-Reported Trouble
Some recent user reviews mention possible security or service problems. One Google Play review dated August 22 said the user experienced spam after what they described as a hack and could no longer open the app.
Another review, dated August 17 and tracked by AppBrain, complained about repeated notifications showing the message “Hack By Coder steam.”
These reports do not establish that Wibuku suffered the alleged database breach. App problems, spam notifications, and a stolen database can have unrelated causes. They are worth noting because they appeared shortly before the current leak claim. More evidence will determine whether there is any connection.
Wibuku’s Security Claims
According to Wibuku’s privacy policy, which it last updated in April 2024, the company takes security measures to protect personal data. Also, the company warns that no security measures guarantee complete protection.
The privacy policy mentions that Wibuku can disclose the information to some service providers who assist in hosting and managing the servers, databases, emails, etc.
Google Play’s current data safety disclosure says Wibuku does not share user data with third parties. The company says they encrypt data in transit.
The two disclosures are not contradictory. Google Play’s policy refers to what the app said about its data-sharing practices, while Wibuku’s focuses on potential third-party providers. Neither document confirms how the actor actually obtained the alleged database.
What Users should do Now
Users should think of it as an unverified breach report for now. If you’ve got a Wibuku account, steer clear of any weird password-reset links or messages about the supposed leak. And seriously, don’t use your Wibuku password for other sites.
If you’ve already reused that password on any other site, change it on those accounts. Then turn on multi -factor authentication where possible. That’ll add an extra layer of protection in case someone steals your login details.
For now, the key question is whether L3yn’s sample is actually from Wibuku. Researchers would need to verify the records and determine when the threat actor obtained them.
It’s also crucial to confirm whether the 200,000 entries the actor claims are unique or duplicates. Until then, the Wibuku incident is merely an alleged data leak, not a confirmed breach.
