Dating App Tea Breach Exposes Users’ IDs and Messages

An app designed to help women spot the “red flags” in their dates became a privacy nightmare when hackers breached its backend. Tea’s users—over 4 million strong—saw selfies, driver’s licenses, and private messages leak onto 4chan, exposing sensitive confessions about infidelity, health, and more.

Background

Launched by software developer Sean Cook, Tea promised an anonymous whistle-network reminiscent of “Are We Dating The Same Guy” Facebook groups. Its surge to the top of Apple’s App Store highlighted a hunger for shared safety tips, but also attracted scrutiny and backlash from users on both sides.

The Breach

On July 25, 2025, 4chan users published 72,000 images from Tea’s Firebase database. Among them were 13,000 selfies and driver’s licenses—documents women had submitted for identity verification until February 2024. Thousands more profile pictures and message threads also became public before Tea detected the hack.

Despite claims that only its “legacy” data was affected, independent researchers found ongoing vulnerabilities exposing private chats about abortion, infidelity, and personal phone numbers. Tea’s promise to delete verification data upon signup no longer holds true.

Expert Critique

“Law enforcement doesn’t set data retention rules—legislatures do,” says Loyola University’s Peter Dordal. He calls Tea’s statement misleading and warns that public cloud buckets should never house unencrypted IDs.

Grant Ho, a security researcher at the University of Chicago, adds, “At a minimum, private data belongs encrypted and behind access controls. Exposing it on a publicly reachable server is negligent.”

Lessons for Developers

• Encrypt sensitive data at rest and in transit, especially IDs and private messages.
• Lock down cloud storage access with strict authentication and minimal permissions.
• Implement clear data retention policies and automate secure deletion after verification.
• Conduct regular third-party security audits to catch misconfigurations before they’re exploited.

Tea’s breach underscores a critical truth: digital whisper networks lose the control and trust their offline counterparts offer. As user-facing platforms gather more personal data, building airtight security becomes not just best practice, but a responsibility to protect every individual in the network.