The Exoliner Serverside data breach

Check if you're in the breach

Enter your Exoliner username, email address, or Discord ID.

Browse the data

What was exposed

Every account has a username, plan, and strike history. Over 1,500 also have an email attached. The script logs cover every script ever run through the service. The tickets are full Discord support conversations, searchable by Discord ID.

User accounts by plan

From a panel statistics snapshot dated 2026-09-28. 13,373 accounts in total.

Panel statistics snapshot

Pulled from Exoliner's admin panel on 2026-09-28.

What to do if you used Exoliner

1. 1. Change your Exoliner password

   If you reused it anywhere else, change it there too, starting with your email account.

2. 2. Turn on two-factor authentication

   Do this on the email account you signed up with.

3. 3. Replace anything secret in your scripts

   If a script you ran through Exoliner contained a webhook URL, API key or token, assume it is exposed and replace it.

4. 4. Distrust messages that mention Exoliner

   A leaked email list is commonly used for phishing. Do not open links or downloads from unexpected messages about your account.

Exoliner's response, fact-checked

On 29 October, Exoliner's owner Lenny posted a "transparency report" in his Discord. Here is what he said, and what the data actually shows.

• "Exoliner was not hacked. No one broke into our servers, database or code."

  A staff member had unrestricted access to every user account, every script log, every ticket, and every moderation record through the mod panel, and exported all of it over months. That a password was not brute-forced does not mean the data was safe. An insider with full panel access downloading everything is a data breach by any definition.

• "About 55 people had typed their email into a ticket, and we're contacting each of them directly."

  The breach contains 1,548 email addresses attached to user accounts, not 55. Lenny is counting only emails typed into support tickets and ignoring the 1,500+ account emails that were also exported from the panel. That is not transparency.

  Verify: Use the breach checker on this page to look up any Exoliner username and see the email field.

• "Passwords, account emails, payment details, IP addresses and 2FA. Staff cannot see any of these."

  1,548 emails were exported through the staff panel. If staff "cannot see" account emails, the panel would not have had them to export. The data is published on this page and anyone can search it.

  Verify: Browse the user data: emails are attached to accounts, pulled from the same panel export.

• "Don't delete your account. Deleting your account doesn't protect anything."

  After a breach that exposed usernames, emails, strike history, every script ever run, and full support ticket conversations, the standard advice is to change passwords and secure linked accounts. Telling users not to delete is protecting Exoliner's subscriber count, not protecting users.

• "We believe kingopher worked with a competitor. Their goal is to scare people away from Exoliner."

  Publishing proof of a data breach is not an attack. The data is real and anyone can verify it. Framing a breach disclosure as a competitor stunt does not make the 13,373 exposed accounts disappear.

• "exoliner.net contains malware. Do not visit these URLs for your safety."

  exoliner.net is hosted on Vercel, the same platform Exoliner uses for exoliner.wtf. It is a static Next.js site with no downloads, no executables, and no scripts that run on your machine. Lenny does not want users seeing the data published here. There is no malware and there never was.

  Verify: You are on exoliner.net right now. Check the source, check VirusTotal, check the Vercel deployment.

• "We are being impersonated by Mario and Isiah. These sites are malicious and being hosted by competitors."

  exoliner.net is owned and operated by serversiding.xyz. It documents Exoliner's conduct using sourced evidence. Documenting someone is not impersonating them.

• "ss.xyz is paying people for sending fake reviews to Exoliner."

  serversiding.xyz has never paid for fake reviews. Lenny posted this after negative Trustpilot reviews from real buyers appeared. He also accused serversiding.xyz of impersonating his buyers, without evidence. Real reviews from real users are not review bombing.

• "Each moderator can now only open the areas their role needs. Bulk exports are detected and blocked."

  These are basic security controls that should have existed from day one. A mod panel with unrestricted access to 13,000+ accounts, no export limits, and no audit alerts ran from June to September before anyone noticed. The fixes are an admission of how bad the original setup was.

• Lenny has used private messages from 2024, when the two were on friendly terms, to discredit Mario.

  Old private conversations between friends prove nothing about the data breach. Sharing private messages to deflect from a security incident is a distraction, not a defense.

• "isn't it funny how our competitors are resorting to threats"

  Lenny operated a Discord DDoS bot service in the past and Exoliner has DDoSed serversiding.xyz multiple times. The DMCA against robloxserversiding.xyz was legitimate: it was a 1:1 copy of serversiding.xyz's website, falsely claimed serversiding.xyz had discontinued, and advised users to buy other products. Vercel took it down after reviewing the claim.

• "obvious attempt to get rid of competition" and "fake breaches"

  403,850 script logs, 1,786 tickets, 13,373 accounts, and 395 moderation actions are published on this page with full search. The data is real, it came from Exoliner's own panel, and Lenny's own transparency report confirms the export happened. It is not fake.

  Verify: Browse the script logs, transcripts, and moderation logs. All searchable, all real.

Questions about the breach