Dating Safety App for Women Hacked, Users Exposed

On July 29, the “Tea” app suspended its direct messaging feature after a second data breach in as many weeks exposed users’ private conversations. The app quickly gained popularity as a “dating safety” tool that allowed women to post anonymous comments about men they dated.

Founded in 2023, the women-only app was originally designed so users could warn each other of behaviors from potential partners, like infidelity, catfishing, or even more dangerous conduct like a history of physical or sexual abuse. The app rose in popularity in the last couple of weeks (even achieving the number one spot in Apple’s App Store).

“Are we dating the same guy? Ask our anonymous community of women to make sure your date is safe, not a catfish, and not in a relationship,” reads the app’s listing on the Google and Apple app stores. Its central premise attracted controversy from some sectors of the internet, including the forum site 4chan.

Around July 25, users on 4chan claimed to have found a vulnerability in Tea’s database. They allegedly published personally identifiable information (PII) from thousands of users, including full names and driver’s licenses, on a public message board.

To create an account, Tea requires users to upload a selfie and other personal information, stating that the information is used to verify the user is a woman.

Shortly after the first leak, investigators from 404 Media found a second vulnerability in the app. This flaw exposed additional personal data, as well as the contents of a database including more than 1.1 million private messages.

“When signing up, Tea encourages users to choose an anonymous screenname, but it was trivial for 404 Media to find the real-world identities of some users given the nature of their messages,” the outlet reported.

Responding to the breach, a Tea spokesperson said: “We are continuing to work expeditiously to contain the incident and have launched a full investigation with assistance from external cybersecurity firms. We have also reached out to law enforcement and are assisting in their investigation. Since our investigation is in its early stages, we do not have more information we can share at this time.”

Cybersecurity attacks targeting a current or potential romantic partner are not uncommon, especially for women. Earlier in July, a breach in the stalkerware app Catwatchful (software used to secretly monitor spouses or partners) exposed the details of more than 62,000 customers worldwide.