artnexus.com — Full Firebase RTDB Exposure: 3,314 Collector Emails + 512 Stripe Sourc

koronelos · 12-08-26, 05:27 PM

thanks mate

timsko775 · 17-08-26, 07:55 PM

(10-08-26, 02:50 PM)exfilar Wrote:
About the leak

ArtNexus — a Colombian-based international fine art magazine and marketplace connecting elite galleries, collectors, and curators across 37 countries — left their Firebase Realtime Database completely exposed. Database artnexus-28f44-default-rtdb.firebaseio.com — no authentication, no token, no referer check. Full read access. Anyone who knows the URL can dump the entire platform.

Inside: 3,314 unique emails belonging to gallery owners, art collectors, museum curators, and private dealers worldwide. 3,455 Firebase user accounts with UIDs mapped to real email addresses. 389 art purchase transactions with product names, amounts, and image URLs. 330 checkout records with COMPLETE SHIPPING ADDRESSES and phone numbers — Switzerland, USA, Portugal, Paraguay, Denmark, UK, UAE, Colombia, Spain, Germany, Argentina, and 25 more countries. 514 payment records with Stripe Source tokens (src_1...) linked to individual user accounts. 90 art purchase requests with buyer-seller negotiation messages.

512 STRIPE SOURCE TOKENS in plaintext format src_1HxExuKSl81HHXwNLAVYjf6K. These are real payment source tokens generated by Stripe.js in production. The Stripe secret key is not in the database itself, but Source tokens combined with any API key leak from the backend or image server become immediately chargeable.

The backend API at artnexus.com:5000 handles image uploads, store purchases, and payment processing. The image server at 3.214.230.236 serves product artwork and magazine covers. Both are referenced throughout the database alongside user data — full infrastructure map exposed.

This is not marketing data. This is the complete operational database of a live art marketplace. Every gallery that registered. Every collector who purchased. Every curator who followed an artist. Every art piece that changed hands. The entire commercial back-end of a premium international art platform — readable with a single HTTP GET.

Date: 10.08.2026
Format: Full Firebase RTDB JSON export (18MB raw) + deep PII extraction + Stripe token dump
Emails: 3,314 unique (gallery owners, collectors, curators, private dealers)
Stripe Source Tokens: 512 (src_1... format — chargeable with API key)
Buy Transactions: 389 with product names, amounts (200-80,000 COP/USD), image URLs
Checkout Records: 330 with full physical addresses + phone numbers in 37 countries
Payment Records: 514 with Stripe tokens linked to specific Firebase user UIDs
User Accounts: 3,455 with Firebase UIDs + email addresses
Purchase Requests: 90 with buyer-seller negotiation messages
API Endpoint: artnexus.com:5000 (image uploads, store, payment processing)
Image Server: 3.214.230.236 (AWS EC2, product/magazine artwork)

Compromised Data Includes

userEmail · uid · nick · galleryEmail · galleryWebsite · galleryLocation · collectorName · curatorEmail · buyAmount · buyProductName · buyImageURL · checkoutAddress · checkoutCity · checkoutCountry · checkoutPhone · checkoutAmount · checkoutStripeToken · paymentSource · paymentAddress · paymentCity · paymentCountry · paymentPhone · requestSenderEmail · requestReceiverEmail · requestMessage · requestTimestamp · cityName · cityCountry · countryNameEn · countryNameEs · productImageURL · transactionTimestamp

Affected Entities

artnexus.com — Colombian fine art magazine and marketplace, operational since 1998
Mor Charpentier Gallery (Paris) — [email protected]
La Balsa Arte (Colombia) — [email protected]
Acacia Galeria (Colombia) — [email protected]
Espacio El Dorado (Colombia) — [email protected]
Galeria Freijo (Spain) — [email protected]
AMS Galeria (Chile) — [email protected]
Galeria El Museo (Colombia) — [email protected]
Gary Nader Art Centre (USA) — [email protected]
Espacio Zafra (Spain) — [email protected]
+ 3,304 more gallery owners, collectors, curators, and private art dealers across 37 countries

Infrastructure Map

firebase rtdb artnexus-28f44-default-rtdb.firebaseio.com — PUBLIC, read access, no auth firebase storage artnexus-28f44.appspot.com — HTTP 404 (not configured) backend API https://artnexus.com:5000 — image uploads, store, payment processing, live image server http://3.214.230.236 — AWS EC2, product artwork and magazine covers, live stripe integration — Source tokens (src_1...) found in buycheckout + payments nodes mongoDB — referenced in City/Country collections (_id format = ObjectId) firebase auth — 3,455 user UIDs mapped to emails, uid format = Firebase Auth

Live Access Status (August 10, 2026)

firebase rtdb read — LIVE (no auth, anonymous HTTP GET on /.json returns full 18MB) firebase rtdb write — UNTESTED (read-only confirmed, write access not attempted) firebase storage — HTTP 404 (not configured) backend API artnexus.com:5000 — LIVE (returns Mongoose connection errors, reveals stack) image server 3.214.230.236:80 — LIVE (serves store artwork and magazine cover images) stripe tokens — 512 src_1 tokens extracted, validation pending (requires secret key leak)

Sample Data — Stripe Source Tokens (512 total)

src_1HxExuKSl81HHXwNLAVYjf6K (Switzerland — Chêne Bougeries 1224, annual subscription) src_1HxF2dKSl81HHXwNidzwUhhK (Switzerland — Chêne Bougeries 1224, art magazine purchase) src_1MXaNBKSl81HHXwN8p56s6Rr (Colombia — Medellín, ArtNexus subscription) src_1RLnZ5KSl81HHXwNP3tpr3Gv (USA — Miami FL, premium art book) src_1Mqlt2KSl81HHXwN55bXj3r6 (Brazil — São Paulo, exhibition catalog) src_1GvYyJKSl81HHXwN5gxq2d8T (Spain — Madrid, annual subscription 4 issues) src_1JkLmNKSl81HHXwN7hfy3p9W (Mexico — CDMX, ArtNexus 118) src_1KrWxPKSl81HHXwN9mku4r1X (Colombia — Bogotá, special edition hardcover) src_1PsTqRKSl81HHXwN2njw5s2Y (USA — New York NY, gallery subscription) src_1QvWuSKSl81HHXwN4plx6t3Z (Argentina — Buenos Aires, ArtNexus digital)

Sample Data — Physical Addresses with Phone Numbers (834 total, 37 countries)

Switzerland: 16 chemin des grangettes, Chêne Bougeries 1224 | +41 22 736 0956 USA: 1235 SW 22nd Street, Miami FL 33145 | +1 305 555 0182 Colombia: Cra 33 #27A-91 Apto 203, Medellín | +57 300 555 0124 Brazil: Rua Augusta 2893, São Paulo SP 01413-000 | +55 11 95555 0125 Spain: Calle Serrano 45, Madrid 28001 | +34 91 555 0126 Mexico: Av. Presidente Masaryk 360, CDMX 11550 | +52 55 5555 0127 Portugal: Rua Garrett 56, Lisboa 1200-204 | +351 21 555 0128 Denmark: Vesterbrogade 43, Copenhagen 1620 | +45 33 555 0129 UK: 14 Cork Street, London W1S 3NS | +44 20 7555 0130 UAE: Gate Village 8, DIFC, Dubai | +971 4 555 0131 Germany: Friedrichstraße 180, Berlin 10117 | +49 30 555 0132 Argentina: Av. Alvear 1580, Buenos Aires C1014 | +54 11 5555 0133 Paraguay: Av. España 980, Asunción | +595 21 555 0134 Chile: Alonso de Córdova 4350, Santiago | +56 2 2555 0135 Uruguay: Sarandí 350, Montevideo 11000 | +598 2 555 0136 Peru: Av. La Paz 1250, Miraflores, Lima | +51 1 555 0137

Sample Data — Purchase Transactions (389 total)

User [email protected] | ARTNEXUS 116 (ARTE EN COLOMBIA 162) | 200 COP User [email protected] | Artnexus #25 (Arte en Colombia #71) English | 800 COP User (Brazilian collector) | Artnexus #30 (Arte en Colombia #76) Spanish | 800 COP User (annual subscriber) | Suscripción 4 ejemplares en 2 años Spanish | 4,000 COP User (premium) | Errores que se consumen con el tiempo 2 (art book) | 80,000 COP User (Switzerland) | Suscripción anual 4 ejemplares al año | 1,500 CHF

Sample Data — Gallery Following List (56 galleries registered)

La Balsa Arte (Cali, Colombia) — [email protected] Acacia Galeria (Bogotá, Colombia) — [email protected] Espacio El Dorado (Bogotá, Colombia) — [email protected] Mor Charpentier (Paris, France) — [email protected] Galeria Freijo (Madrid, Spain) — [email protected] AMS Galeria (Santiago, Chile) — [email protected] Galeria El Museo (Bogotá, Colombia) — [email protected] Gary Nader Art Centre (Miami, USA) — [email protected] Espacio Zafra (Spain) — [email protected] Espacio Arte (Chile) — [email protected] + 46 more registered galleries with emails, websites, and physical locations

Sample Data — Art Purchase Requests (90 total)

[email protected] → Gallery: "And location" (requesting gallery address for pickup) [email protected] → Gallery: "and price" (negotiating artwork price) [email protected] → Gallery: "price, shipping.. framed?" (full purchase inquiry) [email protected] → Gallery: "available? dimensions and shipping to Madrid" [email protected] → Gallery: "still available? interested in all 3 pieces" [email protected] → Gallery: "can you ship to Bogotá? framed or unframed?" [email protected] → Gallery: "catalog availability for upcoming exhibition" [email protected] → Gallery: "commission inquiry for private collection"

Email Samples (3,314 unique)

[email protected] (Mor Charpentier Gallery, Paris) [email protected] (La Balsa Arte, Colombia) [email protected] (Acacia Galeria, Colombia) [email protected] (Espacio El Dorado, Colombia) [email protected] (Galeria Freijo, Spain) [email protected] (AMS Galeria, Chile) [email protected] (Gary Nader Art Centre, USA) [email protected] (Espace Zafra, Spain) [email protected] (Galeria El Museo, Colombia) [email protected] (Artespacio, Chile) [email protected] (private collector) [email protected] (private collector, Brazil) [email protected] (private collector) [email protected] (private collector) [email protected] (private collector) [email protected] (private collector) [email protected] (art professional) [email protected] (private curator) [email protected] (art collector) [email protected] (private collector) + 3,294 more

City & Country Database (339 cities, 37 countries)

New York, Salt Lake City, Newark, New Haven, Naples (USA) Bogotá, Medellín, Cali, Manizales (Colombia) São Paulo, Rio de Janeiro (Brazil) Madrid, Barcelona (Spain) CDMX, Monterrey (Mexico) Santiago (Chile) Montevideo (Uruguay) Lisbon (Portugal) Copenhagen (Denmark) London, Manchester (UK) Dubai (UAE) Berlin (Germany) Buenos Aires (Argentina) Asunción (Paraguay) Zürich, Geneva (Switzerland) Paris (France) + 22 more countries

What's in the dump

· artnexus-28f44_full.json — complete 18MB Firebase RTDB export · artnexus_all_emails.txt — 3,314 unique gallery/collector/curator email addresses · artnexus_stripe_tokens.txt — 512 Stripe Source tokens (src_1... format) · artnexus_stripe_tokens_with_paths.json — 512 tokens with JSON paths for traceability · artnexus_buy_transactions.json — 389 art purchases with amounts and products · artnexus_checkouts.json — 330 checkout records with full addresses + phone + Stripe tokens · artnexus_payments.json — 514 payment records with Stripe tokens linked to user UIDs · artnexus_addresses.json — 834 physical addresses with phone numbers in 37 countries · artnexus_users.json — 3,455 Firebase Auth user accounts (UID + email + nick) · artnexus_purchase_requests.json — 90 buyer-seller art negotiation messages · artnexus_SUMMARY.json — comprehensive JSON finding summary with country breakdown Total: 18MB raw / ~3MB extracted PII

Final word

ArtNexus has been the leading Latin American art publication since 1998. They cover Bienal de São Paulo, ARCO Madrid, Art Basel Miami Beach, FIAC Paris, Frieze London — the entire international art circuit. Their platform connects galleries across Europe and the Americas with private collectors who spend thousands of dollars per transaction.

This database is the operational backbone of that marketplace. Every gallery that signed up to be discovered. Every collector who made a purchase. Every curator who built a following list. Every physical address where art was shipped. Every payment token that moved money. All readable with a single curl command.

The 512 Stripe Source tokens are the killer. These are not test tokens. They're tied to real Stripe accounts, real customer addresses, real amounts in COP, CHF, USD, EUR, and BRL. The Stripe secret key is missing from this dump but the backend at artnexus.com:5000 has been exposing Mongoose connection errors and stack traces to unauthenticated visitors. The API key leak surface is massive — image upload endpoints, store checkout handlers, payment processing middleware. One more step and those 512 tokens become chargeable.

3,314 people in the global art market just had their professional identities exposed. Gallery owners who negotiate six-figure deals. Collectors who pay premium prices for discretion. Curators who build careers on exclusive relationships. Every one of them is in this dump — with their purchase history, their physical address, their phone number, and in 512 cases, their payment token.

The database structure reveals the entire business logic: how galleries register, how collectors follow artists, how purchases flow through checkout, how payments are processed via Stripe, how negotiation messages are routed between buyers and sellers. This is the complete commercial blueprint of a premium art marketplace.

ArtNexus is 12/25 from the FireMass v6.2 pipeline — 207 exposed databases, 10 fully writeable storage buckets, 5,931+ emails, 512 Stripe tokens, 2,381 credit card numbers total. More drops from the pipeline soon. Same exploit. Different companies.

DOWNLOAD

Leaked via FireMass v6.2 pipeline — @~~exfilar~~ | Drop 12/25 from 10.08.2026

╔══════════════════════════════════════════════════════════════════════╗ ║ @EXFILAR — OFFENSIVE SECURITY ║ ║ Red Team Operations & Penetration Testing ║ ╚══════════════════════════════════════════════════════════════════════╝

I offer professional penetration testing and red team operations. Engagements from $2,000 — full-scope web app, API, cloud infrastructure, and mobile security assessments. Custom pricing for long-term retainer contracts and recurring quarterly audits.

All testing is performed with proprietary in-house tooling not available in any public or commercial scanner. Every finding includes CVSS scoring, exploit chain documentation, working PoC code, and remediation guidance.

Contact: @~~exfilar~~

chupavaginas3000 · 20-08-26, 05:27 AM

(10-08-26, 02:50 PM)exfilar Wrote:
About the leak

ArtNexus — a Colombian-based international fine art magazine and marketplace connecting elite galleries, collectors, and curators across 37 countries — left their Firebase Realtime Database completely exposed. Database artnexus-28f44-default-rtdb.firebaseio.com — no authentication, no token, no referer check. Full read access. Anyone who knows the URL can dump the entire platform.

Inside: 3,314 unique emails belonging to gallery owners, art collectors, museum curators, and private dealers worldwide. 3,455 Firebase user accounts with UIDs mapped to real email addresses. 389 art purchase transactions with product names, amounts, and image URLs. 330 checkout records with COMPLETE SHIPPING ADDRESSES and phone numbers — Switzerland, USA, Portugal, Paraguay, Denmark, UK, UAE, Colombia, Spain, Germany, Argentina, and 25 more countries. 514 payment records with Stripe Source tokens (src_1...) linked to individual user accounts. 90 art purchase requests with buyer-seller negotiation messages.

512 STRIPE SOURCE TOKENS in plaintext format src_1HxExuKSl81HHXwNLAVYjf6K. These are real payment source tokens generated by Stripe.js in production. The Stripe secret key is not in the database itself, but Source tokens combined with any API key leak from the backend or image server become immediately chargeable.

The backend API at artnexus.com:5000 handles image uploads, store purchases, and payment processing. The image server at 3.214.230.236 serves product artwork and magazine covers. Both are referenced throughout the database alongside user data — full infrastructure map exposed.

This is not marketing data. This is the complete operational database of a live art marketplace. Every gallery that registered. Every collector who purchased. Every curator who followed an artist. Every art piece that changed hands. The entire commercial back-end of a premium international art platform — readable with a single HTTP GET.

Date: 10.08.2026
Format: Full Firebase RTDB JSON export (18MB raw) + deep PII extraction + Stripe token dump
Emails: 3,314 unique (gallery owners, collectors, curators, private dealers)
Stripe Source Tokens: 512 (src_1... format — chargeable with API key)
Buy Transactions: 389 with product names, amounts (200-80,000 COP/USD), image URLs
Checkout Records: 330 with full physical addresses + phone numbers in 37 countries
Payment Records: 514 with Stripe tokens linked to specific Firebase user UIDs
User Accounts: 3,455 with Firebase UIDs + email addresses
Purchase Requests: 90 with buyer-seller negotiation messages
API Endpoint: artnexus.com:5000 (image uploads, store, payment processing)
Image Server: 3.214.230.236 (AWS EC2, product/magazine artwork)

Compromised Data Includes

userEmail · uid · nick · galleryEmail · galleryWebsite · galleryLocation · collectorName · curatorEmail · buyAmount · buyProductName · buyImageURL · checkoutAddress · checkoutCity · checkoutCountry · checkoutPhone · checkoutAmount · checkoutStripeToken · paymentSource · paymentAddress · paymentCity · paymentCountry · paymentPhone · requestSenderEmail · requestReceiverEmail · requestMessage · requestTimestamp · cityName · cityCountry · countryNameEn · countryNameEs · productImageURL · transactionTimestamp

Affected Entities

artnexus.com — Colombian fine art magazine and marketplace, operational since 1998
Mor Charpentier Gallery (Paris) — [email protected]
La Balsa Arte (Colombia) — [email protected]
Acacia Galeria (Colombia) — [email protected]
Espacio El Dorado (Colombia) — [email protected]
Galeria Freijo (Spain) — [email protected]
AMS Galeria (Chile) — [email protected]
Galeria El Museo (Colombia) — [email protected]
Gary Nader Art Centre (USA) — [email protected]
Espacio Zafra (Spain) — [email protected]
+ 3,304 more gallery owners, collectors, curators, and private art dealers across 37 countries

Infrastructure Map

firebase rtdb artnexus-28f44-default-rtdb.firebaseio.com — PUBLIC, read access, no auth firebase storage artnexus-28f44.appspot.com — HTTP 404 (not configured) backend API https://artnexus.com:5000 — image uploads, store, payment processing, live image server http://3.214.230.236 — AWS EC2, product artwork and magazine covers, live stripe integration — Source tokens (src_1...) found in buycheckout + payments nodes mongoDB — referenced in City/Country collections (_id format = ObjectId) firebase auth — 3,455 user UIDs mapped to emails, uid format = Firebase Auth

Live Access Status (August 10, 2026)

firebase rtdb read — LIVE (no auth, anonymous HTTP GET on /.json returns full 18MB) firebase rtdb write — UNTESTED (read-only confirmed, write access not attempted) firebase storage — HTTP 404 (not configured) backend API artnexus.com:5000 — LIVE (returns Mongoose connection errors, reveals stack) image server 3.214.230.236:80 — LIVE (serves store artwork and magazine cover images) stripe tokens — 512 src_1 tokens extracted, validation pending (requires secret key leak)

Sample Data — Stripe Source Tokens (512 total)

src_1HxExuKSl81HHXwNLAVYjf6K (Switzerland — Chêne Bougeries 1224, annual subscription) src_1HxF2dKSl81HHXwNidzwUhhK (Switzerland — Chêne Bougeries 1224, art magazine purchase) src_1MXaNBKSl81HHXwN8p56s6Rr (Colombia — Medellín, ArtNexus subscription) src_1RLnZ5KSl81HHXwNP3tpr3Gv (USA — Miami FL, premium art book) src_1Mqlt2KSl81HHXwN55bXj3r6 (Brazil — São Paulo, exhibition catalog) src_1GvYyJKSl81HHXwN5gxq2d8T (Spain — Madrid, annual subscription 4 issues) src_1JkLmNKSl81HHXwN7hfy3p9W (Mexico — CDMX, ArtNexus 118) src_1KrWxPKSl81HHXwN9mku4r1X (Colombia — Bogotá, special edition hardcover) src_1PsTqRKSl81HHXwN2njw5s2Y (USA — New York NY, gallery subscription) src_1QvWuSKSl81HHXwN4plx6t3Z (Argentina — Buenos Aires, ArtNexus digital)

Sample Data — Physical Addresses with Phone Numbers (834 total, 37 countries)

Switzerland: 16 chemin des grangettes, Chêne Bougeries 1224 | +41 22 736 0956 USA: 1235 SW 22nd Street, Miami FL 33145 | +1 305 555 0182 Colombia: Cra 33 #27A-91 Apto 203, Medellín | +57 300 555 0124 Brazil: Rua Augusta 2893, São Paulo SP 01413-000 | +55 11 95555 0125 Spain: Calle Serrano 45, Madrid 28001 | +34 91 555 0126 Mexico: Av. Presidente Masaryk 360, CDMX 11550 | +52 55 5555 0127 Portugal: Rua Garrett 56, Lisboa 1200-204 | +351 21 555 0128 Denmark: Vesterbrogade 43, Copenhagen 1620 | +45 33 555 0129 UK: 14 Cork Street, London W1S 3NS | +44 20 7555 0130 UAE: Gate Village 8, DIFC, Dubai | +971 4 555 0131 Germany: Friedrichstraße 180, Berlin 10117 | +49 30 555 0132 Argentina: Av. Alvear 1580, Buenos Aires C1014 | +54 11 5555 0133 Paraguay: Av. España 980, Asunción | +595 21 555 0134 Chile: Alonso de Córdova 4350, Santiago | +56 2 2555 0135 Uruguay: Sarandí 350, Montevideo 11000 | +598 2 555 0136 Peru: Av. La Paz 1250, Miraflores, Lima | +51 1 555 0137

Sample Data — Purchase Transactions (389 total)

User [email protected] | ARTNEXUS 116 (ARTE EN COLOMBIA 162) | 200 COP User [email protected] | Artnexus #25 (Arte en Colombia #71) English | 800 COP User (Brazilian collector) | Artnexus #30 (Arte en Colombia #76) Spanish | 800 COP User (annual subscriber) | Suscripción 4 ejemplares en 2 años Spanish | 4,000 COP User (premium) | Errores que se consumen con el tiempo 2 (art book) | 80,000 COP User (Switzerland) | Suscripción anual 4 ejemplares al año | 1,500 CHF

Sample Data — Gallery Following List (56 galleries registered)

La Balsa Arte (Cali, Colombia) — [email protected] Acacia Galeria (Bogotá, Colombia) — [email protected] Espacio El Dorado (Bogotá, Colombia) — [email protected] Mor Charpentier (Paris, France) — [email protected] Galeria Freijo (Madrid, Spain) — [email protected] AMS Galeria (Santiago, Chile) — [email protected] Galeria El Museo (Bogotá, Colombia) — [email protected] Gary Nader Art Centre (Miami, USA) — [email protected] Espacio Zafra (Spain) — [email protected] Espacio Arte (Chile) — [email protected] + 46 more registered galleries with emails, websites, and physical locations

Sample Data — Art Purchase Requests (90 total)

[email protected] → Gallery: "And location" (requesting gallery address for pickup) [email protected] → Gallery: "and price" (negotiating artwork price) [email protected] → Gallery: "price, shipping.. framed?" (full purchase inquiry) [email protected] → Gallery: "available? dimensions and shipping to Madrid" [email protected] → Gallery: "still available? interested in all 3 pieces" [email protected] → Gallery: "can you ship to Bogotá? framed or unframed?" [email protected] → Gallery: "catalog availability for upcoming exhibition" [email protected] → Gallery: "commission inquiry for private collection"

Email Samples (3,314 unique)

[email protected] (Mor Charpentier Gallery, Paris) [email protected] (La Balsa Arte, Colombia) [email protected] (Acacia Galeria, Colombia) [email protected] (Espacio El Dorado, Colombia) [email protected] (Galeria Freijo, Spain) [email protected] (AMS Galeria, Chile) [email protected] (Gary Nader Art Centre, USA) [email protected] (Espace Zafra, Spain) [email protected] (Galeria El Museo, Colombia) [email protected] (Artespacio, Chile) [email protected] (private collector) [email protected] (private collector, Brazil) [email protected] (private collector) [email protected] (private collector) [email protected] (private collector) [email protected] (private collector) [email protected] (art professional) [email protected] (private curator) [email protected] (art collector) [email protected] (private collector) + 3,294 more

City & Country Database (339 cities, 37 countries)

New York, Salt Lake City, Newark, New Haven, Naples (USA) Bogotá, Medellín, Cali, Manizales (Colombia) São Paulo, Rio de Janeiro (Brazil) Madrid, Barcelona (Spain) CDMX, Monterrey (Mexico) Santiago (Chile) Montevideo (Uruguay) Lisbon (Portugal) Copenhagen (Denmark) London, Manchester (UK) Dubai (UAE) Berlin (Germany) Buenos Aires (Argentina) Asunción (Paraguay) Zürich, Geneva (Switzerland) Paris (France) + 22 more countries

What's in the dump

· artnexus-28f44_full.json — complete 18MB Firebase RTDB export · artnexus_all_emails.txt — 3,314 unique gallery/collector/curator email addresses · artnexus_stripe_tokens.txt — 512 Stripe Source tokens (src_1... format) · artnexus_stripe_tokens_with_paths.json — 512 tokens with JSON paths for traceability · artnexus_buy_transactions.json — 389 art purchases with amounts and products · artnexus_checkouts.json — 330 checkout records with full addresses + phone + Stripe tokens · artnexus_payments.json — 514 payment records with Stripe tokens linked to user UIDs · artnexus_addresses.json — 834 physical addresses with phone numbers in 37 countries · artnexus_users.json — 3,455 Firebase Auth user accounts (UID + email + nick) · artnexus_purchase_requests.json — 90 buyer-seller art negotiation messages · artnexus_SUMMARY.json — comprehensive JSON finding summary with country breakdown Total: 18MB raw / ~3MB extracted PII

Final word

ArtNexus has been the leading Latin American art publication since 1998. They cover Bienal de São Paulo, ARCO Madrid, Art Basel Miami Beach, FIAC Paris, Frieze London — the entire international art circuit. Their platform connects galleries across Europe and the Americas with private collectors who spend thousands of dollars per transaction.

This database is the operational backbone of that marketplace. Every gallery that signed up to be discovered. Every collector who made a purchase. Every curator who built a following list. Every physical address where art was shipped. Every payment token that moved money. All readable with a single curl command.

The 512 Stripe Source tokens are the killer. These are not test tokens. They're tied to real Stripe accounts, real customer addresses, real amounts in COP, CHF, USD, EUR, and BRL. The Stripe secret key is missing from this dump but the backend at artnexus.com:5000 has been exposing Mongoose connection errors and stack traces to unauthenticated visitors. The API key leak surface is massive — image upload endpoints, store checkout handlers, payment processing middleware. One more step and those 512 tokens become chargeable.

3,314 people in the global art market just had their professional identities exposed. Gallery owners who negotiate six-figure deals. Collectors who pay premium prices for discretion. Curators who build careers on exclusive relationships. Every one of them is in this dump — with their purchase history, their physical address, their phone number, and in 512 cases, their payment token.

The database structure reveals the entire business logic: how galleries register, how collectors follow artists, how purchases flow through checkout, how payments are processed via Stripe, how negotiation messages are routed between buyers and sellers. This is the complete commercial blueprint of a premium art marketplace.

ArtNexus is 12/25 from the FireMass v6.2 pipeline — 207 exposed databases, 10 fully writeable storage buckets, 5,931+ emails, 512 Stripe tokens, 2,381 credit card numbers total. More drops from the pipeline soon. Same exploit. Different companies.

DOWNLOAD

Leaked via FireMass v6.2 pipeline — @~~exfilar~~ | Drop 12/25 from 10.08.2026

╔══════════════════════════════════════════════════════════════════════╗ ║ @EXFILAR — OFFENSIVE SECURITY ║ ║ Red Team Operations & Penetration Testing ║ ╚══════════════════════════════════════════════════════════════════════╝

I offer professional penetration testing and red team operations. Engagements from $2,000 — full-scope web app, API, cloud infrastructure, and mobile security assessments. Custom pricing for long-term retainer contracts and recurring quarterly audits.

All testing is performed with proprietary in-house tooling not available in any public or commercial scanner. Every finding includes CVSS scoring, exploit chain documentation, working PoC code, and remediation guidance.

Contact: @~~exfilar~~

burroski · (This post was last modified: 21-08-26, 11:28 AM by burroski.)

thanks bro

thanks bro!!!!!!!!!!!!

thanks bro

midaf319 · 24-08-26, 09:57 PM

thanks

urfate · 25-08-26, 01:26 PM

(10-08-26, 02:50 PM)exfilar Wrote:
About the leak

ArtNexus — a Colombian-based international fine art magazine and marketplace connecting elite galleries, collectors, and curators across 37 countries — left their Firebase Realtime Database completely exposed. Database artnexus-28f44-default-rtdb.firebaseio.com — no authentication, no token, no referer check. Full read access. Anyone who knows the URL can dump the entire platform.

Inside: 3,314 unique emails belonging to gallery owners, art collectors, museum curators, and private dealers worldwide. 3,455 Firebase user accounts with UIDs mapped to real email addresses. 389 art purchase transactions with product names, amounts, and image URLs. 330 checkout records with COMPLETE SHIPPING ADDRESSES and phone numbers — Switzerland, USA, Portugal, Paraguay, Denmark, UK, UAE, Colombia, Spain, Germany, Argentina, and 25 more countries. 514 payment records with Stripe Source tokens (src_1...) linked to individual user accounts. 90 art purchase requests with buyer-seller negotiation messages.

512 STRIPE SOURCE TOKENS in plaintext format src_1HxExuKSl81HHXwNLAVYjf6K. These are real payment source tokens generated by Stripe.js in production. The Stripe secret key is not in the database itself, but Source tokens combined with any API key leak from the backend or image server become immediately chargeable.

The backend API at artnexus.com:5000 handles image uploads, store purchases, and payment processing. The image server at 3.214.230.236 serves product artwork and magazine covers. Both are referenced throughout the database alongside user data — full infrastructure map exposed.

This is not marketing data. This is the complete operational database of a live art marketplace. Every gallery that registered. Every collector who purchased. Every curator who followed an artist. Every art piece that changed hands. The entire commercial back-end of a premium international art platform — readable with a single HTTP GET.

Date: 10.08.2026
Format: Full Firebase RTDB JSON export (18MB raw) + deep PII extraction + Stripe token dump
Emails: 3,314 unique (gallery owners, collectors, curators, private dealers)
Stripe Source Tokens: 512 (src_1... format — chargeable with API key)
Buy Transactions: 389 with product names, amounts (200-80,000 COP/USD), image URLs
Checkout Records: 330 with full physical addresses + phone numbers in 37 countries
Payment Records: 514 with Stripe tokens linked to specific Firebase user UIDs
User Accounts: 3,455 with Firebase UIDs + email addresses
Purchase Requests: 90 with buyer-seller negotiation messages
API Endpoint: artnexus.com:5000 (image uploads, store, payment processing)
Image Server: 3.214.230.236 (AWS EC2, product/magazine artwork)

Compromised Data Includes

userEmail · uid · nick · galleryEmail · galleryWebsite · galleryLocation · collectorName · curatorEmail · buyAmount · buyProductName · buyImageURL · checkoutAddress · checkoutCity · checkoutCountry · checkoutPhone · checkoutAmount · checkoutStripeToken · paymentSource · paymentAddress · paymentCity · paymentCountry · paymentPhone · requestSenderEmail · requestReceiverEmail · requestMessage · requestTimestamp · cityName · cityCountry · countryNameEn · countryNameEs · productImageURL · transactionTimestamp

Affected Entities

artnexus.com — Colombian fine art magazine and marketplace, operational since 1998
Mor Charpentier Gallery (Paris) — [email protected]
La Balsa Arte (Colombia) — [email protected]
Acacia Galeria (Colombia) — [email protected]
Espacio El Dorado (Colombia) — [email protected]
Galeria Freijo (Spain) — [email protected]
AMS Galeria (Chile) — [email protected]
Galeria El Museo (Colombia) — [email protected]
Gary Nader Art Centre (USA) — [email protected]
Espacio Zafra (Spain) — [email protected]
+ 3,304 more gallery owners, collectors, curators, and private art dealers across 37 countries

Infrastructure Map

firebase rtdb artnexus-28f44-default-rtdb.firebaseio.com — PUBLIC, read access, no auth firebase storage artnexus-28f44.appspot.com — HTTP 404 (not configured) backend API https://artnexus.com:5000 — image uploads, store, payment processing, live image server http://3.214.230.236 — AWS EC2, product artwork and magazine covers, live stripe integration — Source tokens (src_1...) found in buycheckout + payments nodes mongoDB — referenced in City/Country collections (_id format = ObjectId) firebase auth — 3,455 user UIDs mapped to emails, uid format = Firebase Auth

Live Access Status (August 10, 2026)

firebase rtdb read — LIVE (no auth, anonymous HTTP GET on /.json returns full 18MB) firebase rtdb write — UNTESTED (read-only confirmed, write access not attempted) firebase storage — HTTP 404 (not configured) backend API artnexus.com:5000 — LIVE (returns Mongoose connection errors, reveals stack) image server 3.214.230.236:80 — LIVE (serves store artwork and magazine cover images) stripe tokens — 512 src_1 tokens extracted, validation pending (requires secret key leak)

Sample Data — Stripe Source Tokens (512 total)

src_1HxExuKSl81HHXwNLAVYjf6K (Switzerland — Chêne Bougeries 1224, annual subscription) src_1HxF2dKSl81HHXwNidzwUhhK (Switzerland — Chêne Bougeries 1224, art magazine purchase) src_1MXaNBKSl81HHXwN8p56s6Rr (Colombia — Medellín, ArtNexus subscription) src_1RLnZ5KSl81HHXwNP3tpr3Gv (USA — Miami FL, premium art book) src_1Mqlt2KSl81HHXwN55bXj3r6 (Brazil — São Paulo, exhibition catalog) src_1GvYyJKSl81HHXwN5gxq2d8T (Spain — Madrid, annual subscription 4 issues) src_1JkLmNKSl81HHXwN7hfy3p9W (Mexico — CDMX, ArtNexus 118) src_1KrWxPKSl81HHXwN9mku4r1X (Colombia — Bogotá, special edition hardcover) src_1PsTqRKSl81HHXwN2njw5s2Y (USA — New York NY, gallery subscription) src_1QvWuSKSl81HHXwN4plx6t3Z (Argentina — Buenos Aires, ArtNexus digital)

Sample Data — Physical Addresses with Phone Numbers (834 total, 37 countries)

Switzerland: 16 chemin des grangettes, Chêne Bougeries 1224 | +41 22 736 0956 USA: 1235 SW 22nd Street, Miami FL 33145 | +1 305 555 0182 Colombia: Cra 33 #27A-91 Apto 203, Medellín | +57 300 555 0124 Brazil: Rua Augusta 2893, São Paulo SP 01413-000 | +55 11 95555 0125 Spain: Calle Serrano 45, Madrid 28001 | +34 91 555 0126 Mexico: Av. Presidente Masaryk 360, CDMX 11550 | +52 55 5555 0127 Portugal: Rua Garrett 56, Lisboa 1200-204 | +351 21 555 0128 Denmark: Vesterbrogade 43, Copenhagen 1620 | +45 33 555 0129 UK: 14 Cork Street, London W1S 3NS | +44 20 7555 0130 UAE: Gate Village 8, DIFC, Dubai | +971 4 555 0131 Germany: Friedrichstraße 180, Berlin 10117 | +49 30 555 0132 Argentina: Av. Alvear 1580, Buenos Aires C1014 | +54 11 5555 0133 Paraguay: Av. España 980, Asunción | +595 21 555 0134 Chile: Alonso de Córdova 4350, Santiago | +56 2 2555 0135 Uruguay: Sarandí 350, Montevideo 11000 | +598 2 555 0136 Peru: Av. La Paz 1250, Miraflores, Lima | +51 1 555 0137

Sample Data — Purchase Transactions (389 total)

User [email protected] | ARTNEXUS 116 (ARTE EN COLOMBIA 162) | 200 COP User [email protected] | Artnexus #25 (Arte en Colombia #71) English | 800 COP User (Brazilian collector) | Artnexus #30 (Arte en Colombia #76) Spanish | 800 COP User (annual subscriber) | Suscripción 4 ejemplares en 2 años Spanish | 4,000 COP User (premium) | Errores que se consumen con el tiempo 2 (art book) | 80,000 COP User (Switzerland) | Suscripción anual 4 ejemplares al año | 1,500 CHF

Sample Data — Gallery Following List (56 galleries registered)

La Balsa Arte (Cali, Colombia) — [email protected] Acacia Galeria (Bogotá, Colombia) — [email protected] Espacio El Dorado (Bogotá, Colombia) — [email protected] Mor Charpentier (Paris, France) — [email protected] Galeria Freijo (Madrid, Spain) — [email protected] AMS Galeria (Santiago, Chile) — [email protected] Galeria El Museo (Bogotá, Colombia) — [email protected] Gary Nader Art Centre (Miami, USA) — [email protected] Espacio Zafra (Spain) — [email protected] Espacio Arte (Chile) — [email protected] + 46 more registered galleries with emails, websites, and physical locations

Sample Data — Art Purchase Requests (90 total)

[email protected] → Gallery: "And location" (requesting gallery address for pickup) [email protected] → Gallery: "and price" (negotiating artwork price) [email protected] → Gallery: "price, shipping.. framed?" (full purchase inquiry) [email protected] → Gallery: "available? dimensions and shipping to Madrid" [email protected] → Gallery: "still available? interested in all 3 pieces" [email protected] → Gallery: "can you ship to Bogotá? framed or unframed?" [email protected] → Gallery: "catalog availability for upcoming exhibition" [email protected] → Gallery: "commission inquiry for private collection"

Email Samples (3,314 unique)

[email protected] (Mor Charpentier Gallery, Paris) [email protected] (La Balsa Arte, Colombia) [email protected] (Acacia Galeria, Colombia) [email protected] (Espacio El Dorado, Colombia) [email protected] (Galeria Freijo, Spain) [email protected] (AMS Galeria, Chile) [email protected] (Gary Nader Art Centre, USA) [email protected] (Espace Zafra, Spain) [email protected] (Galeria El Museo, Colombia) [email protected] (Artespacio, Chile) [email protected] (private collector) [email protected] (private collector, Brazil) [email protected] (private collector) [email protected] (private collector) [email protected] (private collector) [email protected] (private collector) [email protected] (art professional) [email protected] (private curator) [email protected] (art collector) [email protected] (private collector) + 3,294 more

City & Country Database (339 cities, 37 countries)

New York, Salt Lake City, Newark, New Haven, Naples (USA) Bogotá, Medellín, Cali, Manizales (Colombia) São Paulo, Rio de Janeiro (Brazil) Madrid, Barcelona (Spain) CDMX, Monterrey (Mexico) Santiago (Chile) Montevideo (Uruguay) Lisbon (Portugal) Copenhagen (Denmark) London, Manchester (UK) Dubai (UAE) Berlin (Germany) Buenos Aires (Argentina) Asunción (Paraguay) Zürich, Geneva (Switzerland) Paris (France) + 22 more countries

What's in the dump

· artnexus-28f44_full.json — complete 18MB Firebase RTDB export · artnexus_all_emails.txt — 3,314 unique gallery/collector/curator email addresses · artnexus_stripe_tokens.txt — 512 Stripe Source tokens (src_1... format) · artnexus_stripe_tokens_with_paths.json — 512 tokens with JSON paths for traceability · artnexus_buy_transactions.json — 389 art purchases with amounts and products · artnexus_checkouts.json — 330 checkout records with full addresses + phone + Stripe tokens · artnexus_payments.json — 514 payment records with Stripe tokens linked to user UIDs · artnexus_addresses.json — 834 physical addresses with phone numbers in 37 countries · artnexus_users.json — 3,455 Firebase Auth user accounts (UID + email + nick) · artnexus_purchase_requests.json — 90 buyer-seller art negotiation messages · artnexus_SUMMARY.json — comprehensive JSON finding summary with country breakdown Total: 18MB raw / ~3MB extracted PII

Final word

ArtNexus has been the leading Latin American art publication since 1998. They cover Bienal de São Paulo, ARCO Madrid, Art Basel Miami Beach, FIAC Paris, Frieze London — the entire international art circuit. Their platform connects galleries across Europe and the Americas with private collectors who spend thousands of dollars per transaction.

This database is the operational backbone of that marketplace. Every gallery that signed up to be discovered. Every collector who made a purchase. Every curator who built a following list. Every physical address where art was shipped. Every payment token that moved money. All readable with a single curl command.

The 512 Stripe Source tokens are the killer. These are not test tokens. They're tied to real Stripe accounts, real customer addresses, real amounts in COP, CHF, USD, EUR, and BRL. The Stripe secret key is missing from this dump but the backend at artnexus.com:5000 has been exposing Mongoose connection errors and stack traces to unauthenticated visitors. The API key leak surface is massive — image upload endpoints, store checkout handlers, payment processing middleware. One more step and those 512 tokens become chargeable.

3,314 people in the global art market just had their professional identities exposed. Gallery owners who negotiate six-figure deals. Collectors who pay premium prices for discretion. Curators who build careers on exclusive relationships. Every one of them is in this dump — with their purchase history, their physical address, their phone number, and in 512 cases, their payment token.

The database structure reveals the entire business logic: how galleries register, how collectors follow artists, how purchases flow through checkout, how payments are processed via Stripe, how negotiation messages are routed between buyers and sellers. This is the complete commercial blueprint of a premium art marketplace.

ArtNexus is 12/25 from the FireMass v6.2 pipeline — 207 exposed databases, 10 fully writeable storage buckets, 5,931+ emails, 512 Stripe tokens, 2,381 credit card numbers total. More drops from the pipeline soon. Same exploit. Different companies.

DOWNLOAD

Leaked via FireMass v6.2 pipeline — @~~exfilar~~ | Drop 12/25 from 10.08.2026

╔══════════════════════════════════════════════════════════════════════╗ ║ @EXFILAR — OFFENSIVE SECURITY ║ ║ Red Team Operations & Penetration Testing ║ ╚══════════════════════════════════════════════════════════════════════╝

I offer professional penetration testing and red team operations. Engagements from $2,000 — full-scope web app, API, cloud infrastructure, and mobile security assessments. Custom pricing for long-term retainer contracts and recurring quarterly audits.

All testing is performed with proprietary in-house tooling not available in any public or commercial scanner. Every finding includes CVSS scoring, exploit chain documentation, working PoC code, and remediation guidance.

Contact: @~~exfilar~~

pttderek · 26-08-26, 09:14 AM

thanks for this

m4lziin44 · 28-08-26, 07:01 PM

thanksyou!!

demo88 · 29-08-26, 08:46 PM

hhjgjhghghj

shadowsun · 10-09-26, 03:21 AM

good man