A legal dispute between two companies involved in managing subscription data for creators on the adult content platform OnlyFans has brought allegations of a large-scale cybercrime conspiracy to light. Court documents reveal that Pavlo Kharmanskyi, a Ukrainian national and operator of a firm called OnlyMonster, faces accusations of orchestrating a cyberattack targeting customer information belonging to Infinni Innovations, a Spanish-based software company that provides customer relationship management (CRM) services to OnlyFans creators and agencies.

OnlyFans, launched in 2016 by Tim Stokely, initially restricted explicit content and focused on creators such as fitness trainers, chefs, and artists. The platform experienced rapid growth after its acquisition by U.S. businessman Leo Radvinsky in 2019, when it opened up to adult content. Today, it boasts over 4 million creators and generates billions of pounds in revenue from tens of millions of subscribers worldwide.

Infinni Innovations operates Infloww, a software platform widely used by agencies representing OnlyFans creators to manage fan interactions and analyze subscriber behavior. According to court filings, Kharmanskyi and his business partner, Danyl Romanov, conducted a series of cyber intrusions in December 2024. The attacks allegedly involved breaking into Infinni’s systems, reverse-engineering software, and employing automated bots to harvest approximately 400,000 user profiles, including detailed "fan notes" containing personal data, subscription histories, and interaction scripts designed to simulate personal conversations with subscribers.

Infinni claims the stolen data was used by OnlyMonster to lure clients away and increase its market share in the fan-management sector. The company responded by orchestrating a sting operation involving a sham firm, which approached OnlyMonster and was told the firm had “cracked” Infloww’s software. This evidence formed the basis of a High Court lawsuit filed in February 2026, accusing Kharmanskyi, Romanov, and OnlyMonster of breach of confidence, conspiracy, and misuse of confidential information. An injunction was granted to prevent further data breaches, demand the return or destruction of stolen data, and seek compensation for losses.

OnlyMonster disputes the allegations, maintaining that it only facilitated the lawful transfer of data from Infinni’s platform to its own on behalf of frustrated agencies that were denied access to their subscriber information. The company argues that these agencies provided their login credentials voluntarily, allowing the migration of fan profiles and interaction scripts. Kharmanskyi and OnlyMonster have filed a counterclaim accusing Infinni of anti-competitive behavior and unlawfully restricting access to subscribed agencies.

The ongoing litigation underscores the increasingly lucrative and competitive ecosystem surrounding OnlyFans, exposing the complex relationships between creators, agencies, and management platforms. Mr Justice Rajesh Saini noted the potential financial impact on agencies if an injunction halted OnlyMonster’s operations.

Kharmanskyi has a criminal record linked to cybercrime; in 2019, he was arrested in Miami for his involvement with the xDedic Marketplace, a site that sold hacked server access, facilitating cyberattacks, fraud, and identity theft amounting to millions. He was sentenced to 30 months in prison in 2021 but was released shortly afterward due to time served. OnlyMonster emphasizes that Kharmanskyi has never been convicted of hacking or cyberattacks, describing his previous case as a plea bargain without adverse implications.

Meanwhile, concerns have emerged about the conduct of agencies managing OnlyFans creators. Some content producers allege these agencies seek excessive control over their personal lives and have issued threats to enforce compliance. OnlyFans has denied any tolerance of such abuses.

As the legal battle unfolds in court next year, it is expected to reveal further details about the shadowy networks supporting the operation and growth of the globally popular platform.