Original article from Hypertext, republished under Creative Commons Attribution-NonCommercial-ShareAlike 4.
- Tea, a dating safety app for women, is the subject of an incredibly alarming data breach.
- Tens of thousands of images submitted by users, including selfies, have been ripped from a Tea server and were posted to 4chan before being removed.
- Despite claiming that the breach only affected users who registered before February 2024, it has now come to light that hackers could read DMs between users as recently as a few weeks ago.
No business wants to shout from the rooftops that it has been breached and that the data their users entrusted them with may be circulating on the internet. It’s bad for public relations and destroys trust. However, just because it feels bad doesn’t mean that the custodians of this data can just sweep a breach under the rug.
Case in point is Tea. Tea is a dating safety app where women can share information about their previous partners in a bid to help other women who may encounter these men in the wild. Tea takes the Facebook groups and cobbled-together websites of old and puts a modern, more easily accessible twist on the practice.
Last week, however, the platform was the subject of a breach.
“We discovered unauthorised access to an archived data system,” Tea wrote in a post on its Instagram page.
“This archived system stored about 72 000 user-submitted images including approximately 13 000 images of selfies and selfies including photo identification submitted during account verification. These photos can in now way be linked to posts within Tea,” the developer wrote.
The company claimed that users who signed up for Tea after February 2024 were safe and that no email addresses or phone number were compromised. However, that’s ignoring the thousands of users who now have their data exposed. Worse still, that data system Tea mentions was posted to 4chan before it was eventually removed.
While photos can’t be linked to accounts, that’s besides the point because even just having one’s ID photo in the data dump could be incredibly dangerous for women.
And to make matters worse, somehow there has been a second incident.
As reported by [404 Media, a security researcher has discovered that it was possible for hackers to access messages between users as recently as last week. This flies in the face of Tea’s statement that no current user data is in danger. As the publication puts it, “it was trivial for 404 Media to find the real world identities of some users given the nature of their messages.”
All this while Tea continues to downplay how serious this is for its users.
Even the developer’s reasoning for why the data was breached is weak as it gets.
“During our early stages of development some legacy content was not migrated into our new fortified system. An unauthorized actor accessed our identifier link where data was stored before February 24, 2024. As we grew our community, we migrated to a more robust and secure solution which has rendered that any new users from February 2024 until now were not connected to the images involved in this incident,” Tea writes in an FAQ.
Excuse us, but what? There was an unsecured database just left somewhere in its system since last year, and Tea did nothing about it. That doesn’t sound like “dating safety tools that protect women” as the app proclaims on its website.
This should be grounds for a business-ending fine because, for the users, there is frankly nothing they can do. Their photos, possibly their messages, and more are now compromise,d and while the database containing that info was removed from 4chan, it could now be just about anywhere.
However, Tea’s social media posts about this breach are awash with users who are begging for Tea to accept their application to join the platform. One user even told the platform, “we don’t care about the leak” which is mighty concerning. There are some who are calling for Tea to rebuild and return with a safer app for the users, but the most vocal commenters simply want access.
What’s next for Tea? We honestly don’t know. A breach like this should be the end for a company, but it seems that Tea’s popularity has outweighed the danger of this incident and will likely grow as time marches on because, despite its security failings, there is a demand for this sort of thing.