OnlyFans Data Theft Allegations Surface in High Court Battle

High Court documents reveal allegations that cyber-criminal Pavlo Kharmanskyi and his firm, OnlyMonster, conspired to steal personal data from a rival company that serves OnlyFans creators and their agencies. The data in question belongs to users of the adult content platform, which has grown into a global phenomenon since its parent company was acquired by U.S. businessman Leo Radvinsky in 2019.

Infinni Innovations, a Spanish-based company that provides customer relationship management software called Infloww to OnlyFans creators, alleges that Kharmanskyi and his business partner Danyl Romanov launched a series of cyber attacks in December 2024. According to Infinni's claims, the defendants hacked into their systems, reverse-engineered the software, and used automated bots to steal approximately 400,000 fan profiles and commercially valuable scripts used to engage subscribers.

These detailed fan notes, described in court filings, include information such as location, age, relationship status, and even personal details like military service and martial arts proficiency. The scripts allegedly stolen are used by some agencies to simulate personal conversations with creators, aiming to encourage subscribers to spend more money on the platform.

Infinni claims it uncovered the alleged theft through a sting operation involving the creation of a fake company that contacted OnlyMonster. Kharmanskyi reportedly admitted that his firm had "cracked Infloww" while attempting to solicit the fake company as a client. This led Infinni to file a lawsuit in the High Court in February, seeking an injunction, the return or destruction of stolen data, and compensation.

OnlyMonster has denied the hacking allegations, asserting that it merely facilitated data transfers for agencies frustrated with Infinni's refusal to provide them with their own client data. The firm claims these agencies provided their Infloww passwords for the transfer of fan profiles and scripts. In a counterclaim, OnlyMonster accuses Infinni of anti-competitive practices and unlawfully locking agencies into its platform.

This is not the first time Kharmanskyi has faced cybercrime accusations. In 2019, he was arrested for his involvement with xDedic Marketplace, a site that reportedly sold access to hacked servers, facilitating millions in fraud. He pleaded guilty to possession of unauthorized access devices and received a 30-month sentence, which he served concurrently with time already spent in custody. An OnlyMonster spokesperson stated that Kharmanskyi has not been convicted of hacking and that his previous case resulted from a plea bargain.

The legal battle between Infinni and OnlyMonster is expected to shed further light on the operational methods and business practices within the ecosystem supporting OnlyFans's significant growth. Recent reports have also surfaced detailing alleged coercion and threats by some agencies against creators on the platform, which OnlyFans has stated it does not condone.