The Tea app knowledge breach has grown into a fair bigger leak, with the stolen knowledge now shared on hacking boards and a second database found that allegedly comprises 1.1 million personal messages exchanged between the app’s members.
The Tea app is a women-only courting security platform the place members can share opinions about males, with entry to the platform solely granted after offering a selfie and authorities ID verification.
On Friday, an nameless consumer posted on 4chan that Tea used an unsecured Firebase storage bucket to retailer drivers’ licenses and selfies uploaded by members to confirm they’re ladies, in addition to images and pictures shared in feedback.
The consumer shared a Python script that may very well be used to obtain the info from the now-secured storage bucket.
In complete, over 59 GB of information was uncovered within the leak, with Tea confirming in a public assertion that it impacts customers who signed up earlier than 2024.
“A legacy knowledge storage system was compromised, leading to unauthorized entry to a dataset from previous to February 2024,” reads a safety breach announcement.
“This dataset contains roughly 72,000 photographs, together with roughly 13,000 selfies and photograph identification submitted by customers throughout account verification and roughly 59,000 photographs publicly viewable within the app from posts, feedback and direct messages.”
The platform states that selfies weren’t deleted as anticipated to adjust to regulation enforcement necessities associated to cyber-bullying prevention.
Menace actors have now begun sharing torrents of the leaked knowledge on hacking boards, doubtlessly exposing the app’s members to social engineering assaults.
BleepingComputer has confirmed that the shared knowledge comprises driver’s licenses, selfies, and message attachments.
To make issues worse, 404 Media now stories that an extra database was discovered containing 1.1 million personal messages despatched between customers on the Tea platform.
This database comprises far more latest knowledge, starting from 2023 to final week, and reportedly contains messages discussing delicate matters, akin to these about abortions, dishonest husbands, and two-timing boyfriends.
Kasra Rahjerdi, the researcher who found the brand new database, informed 404 Media that any Tea consumer may entry the saved consumer knowledge utilizing their very own API key.
Based on 404 Media, it is attainable to establish customers primarily based on social media profiles, cellphone numbers, or different private particulars revealed within the messages.
What was meant to be a protected house for girls has now turn into a device to embarrass them, with somebody even making a “facesmash”-style web site the place guests can fee the selfies uncovered within the leaked knowledge.
Tea says they proceed to work with third-party cybersecurity specialists to comprise the incident and conduct an investigation into the assault.
The app says that it additionally notified regulation enforcement, who’re helping with the investigation.
Comprise rising threats in actual time – earlier than they impression your enterprise.
Learn the way cloud detection and response (CDR) offers safety groups the sting they want on this sensible, no-nonsense information.
