The Tea app information breach has grown into an excellent bigger leak, with the stolen information now shared on hacking boards and a second database found that allegedly comprises 1.1 million non-public messages exchanged between the app’s members.
The Tea app is a women-only courting security platform the place members can share evaluations about males, with entry to the platform solely granted after offering a selfie and authorities ID verification.
On Friday, an nameless person posted on 4chan that Tea used an unsecured Firebase storage bucket to retailer drivers’ licenses and selfies uploaded by members to confirm they’re ladies, in addition to photographs and pictures shared in feedback.
The person shared a Python script that could possibly be used to obtain the information from the now-secured storage bucket.
In complete, over 59 GB of knowledge was uncovered within the leak, with Tea confirming in a public assertion that it impacts customers who signed up earlier than 2024.
“A legacy information storage system was compromised, leading to unauthorized entry to a dataset from previous to February 2024,” reads a safety breach announcement.
“This dataset consists of roughly 72,000 photographs, together with roughly 13,000 selfies and photograph identification submitted by customers throughout account verification and roughly 59,000 photographs publicly viewable within the app from posts, feedback and direct messages.”
The platform states that selfies weren’t deleted as anticipated to adjust to regulation enforcement necessities associated to cyber-bullying prevention.
Risk actors have now begun sharing torrents of the leaked information on hacking boards, probably exposing the app’s members to social engineering assaults.
BleepingComputer has confirmed that the shared information comprises driver’s licenses, selfies, and message attachments.
To make issues worse, 404 Media now stories that a further database was discovered containing 1.1 million non-public messages despatched between customers on the Tea platform.
This database comprises way more current information, starting from 2023 to final week, and reportedly consists of messages discussing delicate matters, corresponding to these about abortions, dishonest husbands, and two-timing boyfriends.
Kasra Rahjerdi, the researcher who found the brand new database, informed 404 Media that any Tea person may entry the saved person information utilizing their very own API key.
In response to 404 Media, it is potential to determine customers primarily based on social media profiles, cellphone numbers, or different private particulars revealed within the messages.
What was meant to be a protected house for girls has now turn into a device to embarrass them, with somebody even making a “facesmash”-style website the place guests can price the selfies uncovered within the leaked information.
Tea says they proceed to work with third-party cybersecurity consultants to include the incident and conduct an investigation into the assault.
The app says that it additionally notified regulation enforcement, who’re aiding with the investigation.
Comprise rising threats in actual time – earlier than they impression what you are promoting.
Learn the way cloud detection and response (CDR) provides safety groups the sting they want on this sensible, no-nonsense information.
