Dating App Tea Faces Major Data Breach Exposing User Information

The dating app Tea, which aims to help women share warnings about men they have dated, has experienced a major security breach that exposed sensitive user data. According to reports, hackers accessed and posted thousands of images, including selfies and driver’s licenses, of mostly female users on the online forum 4chan. Private messages discussing personal topics such as infidelity and abortion were also found to be vulnerable to unauthorized access.

Tea, which recently reached the top of Apple’s App Store and claims over 4 million active users, confirmed it is working with external cybersecurity firms and law enforcement to investigate the incident. The company stated that it had launched “a full investigation with assistance from external cybersecurity firms,” and is cooperating with authorities.

The breach reportedly involved 72,000 images, with 13,000 being selfies and driver’s licenses, and the rest consisting of other user-uploaded content. While Tea initially said that only users who signed up before February 2024 were affected, independent researchers found that messages sent as recently as last week remain accessible, indicating ongoing security risks.

Experts have criticized Tea’s use of Firebase, a Google-owned cloud service, for storing sensitive information without adequate protections. Peter Dordal, a professor of online networks and security at Loyola University Chicago, said the company’s claim of legal compliance was “misleading,” noting that law enforcement does not set such requirements and that sensitive images should not have been publicly accessible. Grant Ho, an assistant professor at the University of Chicago, described the company’s security practices as negligent, stating that private data should not be stored on publicly accessible servers and should be encrypted at a minimum.

The incident has also sparked backlash from online communities, including men’s rights groups, some of whom have criticized the app as defamatory. A retaliatory app was briefly launched but was quickly taken down after reports of misuse.

Andrew Guthrie Ferguson, a law professor at George Washington University, commented that digital whisper networks lack the privacy of offline ones, warning, “You lose control over it. You can’t keep it within the confines of people you trust.”