Tea Dating App Confirms Data Breach Exposing Thousands of User Images

Tea, a dating app that enables women to share information about men for safety purposes, reported that a data storage breach led to unauthorized access of 72,000 images, including approximately 13,000 selfies submitted for account verification before February 2024. The company stated that these verification photos are typically deleted after account approval, while another 59,000 images accessed were already publicly viewable within the app.

The incident has prompted renewed concerns about privacy and the security of personal data on dating platforms. Rachel Tobac, CEO and co-founder of SocialProof Security, noted that even seemingly harmless selfies can become valuable to cybercriminals when combined with other personal information. She advised affected users to consider freezing their credit, removing personal data from brokerage sites, making social media accounts private, and using password managers and multifactor authentication.

Tobac also highlighted the risks companies face when collecting sensitive information for identity or age verification. > "Any information that you collect, you have to protect. And the more information you collect, the more interesting of a target you are for cyber criminals," she said.

Albert Fox Cahn, founder and executive director of the Surveillance Technology Oversight Project, cautioned against normalizing facial recognition in such apps, warning that it increases risks from both hackers and law enforcement misuse. > "We all know online dating can be toxic, but the solution isn’t more surveillance," Cahn said, recommending that users limit the data they share with companies.

Richard Blech, CEO of AI security firm XSOC Corp., described selfies and images as a "data goldmine" for artificial intelligence-driven attacks, which could include facial recognition spoofing, biometric bypassing, and deepfakes. He urged vigilance, noting that biometric data, unlike passwords, cannot be changed if compromised. > "You’re not getting a new number or changing your password. There’s going to be action on that stolen information. There’s no question about it," Blech said.

The breach at Tea follows similar incidents at other dating platforms, underscoring ongoing challenges in protecting user privacy and data security in the industry.