The Tea app knowledge breach has grown into a fair bigger leak, with the stolen knowledge now shared on hacking boards and a second database found that allegedly comprises 1.1 million non-public messages exchanged between the app’s members.
The Tea app is a women-only courting security platform the place members can share evaluations about males, with entry to the platform solely granted after offering a selfie and authorities ID verification.
On Friday, an nameless person posted on 4chan that Tea used an unsecured Firebase storage bucket to retailer drivers’ licenses and selfies uploaded by members to confirm they’re ladies, in addition to images and pictures shared in feedback.
The person shared a Python script that may very well be used to obtain the information from the now-secured storage bucket.
In complete, over 59 GB of knowledge was uncovered within the leak, with Tea confirming in a public assertion that it impacts customers who signed up earlier than 2024.
“A legacy knowledge storage system was compromised, leading to unauthorized entry to a dataset from previous to February 2024,” reads a safety breach announcement.
“This dataset contains roughly 72,000 pictures, together with roughly 13,000 selfies and photograph identification submitted by customers throughout account verification and roughly 59,000 pictures publicly viewable within the app from posts, feedback and direct messages.”
The platform states that selfies weren’t deleted as anticipated to adjust to legislation enforcement necessities associated to cyber-bullying prevention.
Risk actors have now begun sharing torrents of the leaked knowledge on hacking boards, doubtlessly exposing the app’s members to social engineering assaults.
BleepingComputer has confirmed that the shared knowledge comprises driver’s licenses, selfies, and message attachments.
To make issues worse, 404 Media now stories that a further database was discovered containing 1.1 million non-public messages despatched between customers on the Tea platform.
This database comprises way more current knowledge, starting from 2023 to final week, and reportedly contains messages discussing delicate subjects, comparable to these about abortions, dishonest husbands, and two-timing boyfriends.
Kasra Rahjerdi, the researcher who found the brand new database, instructed 404 Media that any Tea person might entry the saved person knowledge utilizing their very own API key.
Based on 404 Media, it is attainable to determine customers based mostly on social media profiles, cellphone numbers, or different private particulars revealed within the messages.
What was meant to be a secure area for girls has now change into a instrument to embarrass them, with somebody even making a “facesmash”-style website the place guests can fee the selfies uncovered within the leaked knowledge.
Tea says they proceed to work with third-party cybersecurity consultants to include the incident and conduct an investigation into the assault.
The app says that it additionally notified legislation enforcement, who’re aiding with the investigation.
CISOs know that getting board buy-in begins with a transparent, strategic view of how cloud safety drives enterprise worth.
This free, editable board report deck helps safety leaders current danger, affect, and priorities in clear enterprise phrases. Flip safety updates into significant conversations and quicker decision-making within the boardroom.
