Tea App Data Breach Explained: 72,000 Images and 1.1 Million Messages Leaked
In July 2025, Tea Dating Advice suffered two catastrophic data breaches that exposed the private information of tens of thousands of users. This guide breaks down exactly what happened, what data was compromised, and what steps you should take if you're affected.
Breach Summary at a Glance
First Breach (July 25)
- • 72,000 images exposed
- • 13,000 verification selfies + IDs
- • Unsecured Firebase database
Second Breach (July 28)
- • 1.1 million private messages
- • Sensitive personal discussions
- • Phone numbers & locations
How the Breaches Happened
The Tea app data breaches represent a textbook case of inadequate cybersecurity practices. According to security researchers, the breaches occurred due to fundamental failures in how Tea stored and protected user data.
The Technical Failure
Security expert Ted Miracco noted that Tea "was not following basic cybersecurity practices" and that data was "stored in such an insecure way" that discovery by malicious actors was essentially inevitable. Key failures included:
- Unencrypted Database: User data, including sensitive images and messages, was stored without proper encryption
- Misconfigured Firebase: A legacy Firebase database was left accessible without authentication
- No Access Controls: Anyone who discovered the database URL could access the data
- Legacy System Neglect: Older data stores weren't properly secured during updates
How Discovery Happened:
The breach was discovered by users on 4chan who found an unsecured database containing Tea user data. Within hours, the data was being shared across multiple platforms, creating websites to "rate" the leaked photos and coordinate harassment campaigns against both the female users of Tea and the men discussed on the platform.
First Breach: 72,000 Images Exposed
The first breach, discovered on July 25, 2025, exposed approximately 72,000 images that had been uploaded to the Tea platform.
What Was Exposed:
Verification Photos (13,000):
- • Selfie photos submitted for account verification
- • Government-issued photo IDs (driver's licenses, passports)
- • Facial recognition data used to verify female identity
User-Generated Content (59,000):
- • Photos from posts about men
- • Screenshots from dating apps and social media
- • Images shared in comments and direct messages
Who Was Affected:
The first breach primarily affected users who registered before February 2024. This includes:
- Early adopters who verified with government IDs
- Men posted on the platform whose photos were shared without consent
- Anyone identifiable in screenshots or posts
Second Breach: 1.1 Million Messages Leaked
Just three days after the first breach was discovered, a second, even more devastating leak occurred. This time, over 1.1 million private messages were exposed.
Message Content Included:
- • Relationship discussions - Detailed conversations about dating experiences
- • Infidelity allegations - Private discussions about suspected cheating
- • Health information - Medical details including STD discussions and abortion decisions
- • Personal identifiers - Phone numbers and location data
- • Meeting arrangements - Times and places where users planned to meet
Timeline of Affected Messages:
The message breach affected communications from February 2023 through the week of the breach - essentially the entire operational history of the app's messaging feature.
The Aftermath: Harassment and Exploitation
The leaked data was quickly weaponized by bad actors across the internet, creating a cascade of harmful consequences:
Harassment of Women Users
- • "Rating" websites created from leaked ID photos
- • Doxxing operations mapping user locations
- • Coordinated harassment on social media
- • Identity theft using exposed government IDs
Damage to Men Posted
- • Accusations spread beyond the app
- • Content now searchable on public internet
- • Professional reputation damage
- • Family discovery of posts
Legal Response and Lawsuits
The breaches triggered immediate legal action against Tea from multiple directions:
Class Action Lawsuits
Multiple class-action lawsuits have been filed alleging:
- • Negligent data security practices
- • Failure to implement basic cybersecurity measures
- • Breach of privacy and confidentiality agreements
- • Violation of state data protection laws
Illinois BIPA Violations
Tea faces particular exposure under Illinois' Biometric Information Privacy Act (BIPA):
- • $1,000 per negligent violation
- • $5,000 per intentional violation
- • Facial recognition data collected without proper consent
- • Biometric data stored without adequate protections
What To Do If You're Affected
For Women Tea Users:
- Check your exposure - Search for your name/images on common platforms
- Enable identity monitoring - Use credit monitoring and identity protection services
- Report harassment - Document and report any harassment to platforms and law enforcement
- Join class actions - Contact attorneys handling Tea breach lawsuits
- Change passwords - Update credentials on any accounts using similar passwords
For Men Posted on Tea:
- Document the damage - Screenshot any leaked content about you
- Search for spread - Check Google, social media for your name + Tea references
- File DMCA takedowns - Remove your copyrighted photos from leaked archives
- Consider legal action - Consult defamation attorneys if false info spread
- Monitor ongoing - Set up Google Alerts for your name
Lessons Learned: Privacy in Dating Apps
The Tea breach offers important lessons about privacy in the age of dating apps:
- Question data collection: Be skeptical of apps requiring government ID uploads
- Assume persistence: Anything uploaded can potentially be leaked later
- Research security practices: Check if apps have experienced past breaches
- Minimize sensitive sharing: Avoid sharing information you wouldn't want public
Conclusion
The Tea app data breaches represent one of the most significant privacy failures in the dating app industry. The exposure of government IDs, private messages, and sensitive personal information has created lasting harm for both the women who used the platform and the men who were discussed on it.
For those affected, the path forward involves vigilant monitoring, proactive content removal, and in many cases, legal action to address the damage caused by Tea's security failures.
Remember: Data breaches create permanent exposure risk. Even if content is removed from one location, it may resurface elsewhere. Continuous monitoring and rapid response remain essential for anyone affected by the Tea breach.