Hacker News

TechCrunch

Tiff In Tech

<h1>Dating Safety App Tea Suffers Major Security Breaches</h1>
Tea, a dating safety app widely used by women to share information about their dating experiences, has faced significant security issues in recent weeks. Over a million private messages and thousands of user images have been exposed due to vulnerabilities in the app’s infrastructure.
The most recent breach involved the exposure of 1.1 million private messages between users, which included sensitive conversations covering personal phone numbers, discussions on abortions, and relationship issues. This incident was discovered by security researcher Kasra Rahjerdi, who identified the vulnerability in the app’s systems. These exposed messages dated from early 2023 to shortly before the breach.
This follows an earlier breach where 72,000 user images were leaked online. The images included 13,000 verification selfies and photo IDs, and an additional 59,000 images from posts and messages. Unfortunately, this breach has led to the sharing of sensitive data on 4chan, exacerbating privacy concerns for users of the app.
The primary technical reason behind these breaches was an unsecured staging environment left online, which required no authentication, used predictable URLs, and stored unencrypted images. The incident serves as a stark reminder of the risks associated with data sprawl, where real user data is used in development environments and left vulnerable due to oversight.
The company has since engaged cybersecurity experts to shore up its defenses and implement additional security measures to prevent further incidents. They are addressing the vulnerabilities by ensuring that test environments do not use actual user data and securing staging servers with appropriate authentication protocols.
Despite these challenges, Tea’s popularity continues, as evidenced by its positioning as the second most downloaded free app on Apple’s App Store. Users who signed up before February 2024 are particularly urged to remain vigilant and take any necessary precautions.

Collections

Tea, a popular dating safety app, experienced major security breaches exposing 1.1 million private messages and 72,000 user images. The breaches occurred due to an unsecured staging environment with no authentication, predictable URLs, and unencrypted data storage. Sensitive user information including phone numbers and verification photos was leaked, with some data appearing on 4chan. The company has engaged cybersecurity experts to implement security measures and ensure test environments don't use real user data.

Dating Safety App Tea Breached, Exposing Sensitive User Data