The Tea app hack explained – how a data breach spilled thousands of photos from the top free US app, and what to do

• Tea is a popular ‘dating safety tool’ that just suffered a data breach
• 72,000 images pertaining to the app were involved, some of which were user photo IDs
• There’s an ongoing investigation, but the obvious worry here is potential identity theft for those whose images were exposed

Tea is a popular mobile app designed as a ‘dating safety tool’ to protect women and has been around since 2023.

Its full name is Tea Dating Advice, and the central idea is a women-only app that gives those who are dating the ability to access background checks on men. This includes whether they have a criminal record (or if they’re sex offenders), as well as reverse image searching to identify catfishing (assuming a false identity online).

At the end of last week, as NBC News reported, Tea admitted that it had suffered a data breach in which 72,000 images were accessed by the intruder.

That included 13,000 images (selfies and photo ID) submitted by users during account verification. The other 59,000 images were also provided by users and “publicly viewable” in posts (and direct messages) on the app.

As Tea acknowledged on its Instagram account, these images were stored on an ‘archived data system’ and the firm said that any users who signed up for Tea during or after February 2024 won’t be affected. In other words, this is old data archived on a server that only pertains to older posts and accounts before that date.

The company made it clear that the photos “can in no way be linked to posts within Tea”.

A Tea spokesperson told NBC: “This data was originally stored in compliance with law enforcement requirements related to cyberbullying prevention.”

NBC reported that the hack may be connected to 4chan, with a 4chan poster allegedly allowing for the database of stolen images to be downloaded on that platform. Supposed ID photos from Tea users are also said to have been posted on some social media outlets, too, but obviously, exercise caution around such reports.

Tea said that it has more than four million users in total, and it became the top free app in Apple’s App Store in the US this past week (having recently gained a million new members).

Tea said it’s conducting an ongoing investigation into the security incident, which includes external cybersecurity experts, and that it has notified law enforcement in the US.

Do you think you’ve been affected by this breach – if so, what should you do?

The key point to remember here is that if you signed up more recently for Tea, you shouldn’t be affected by this breach. As noted, the impact only extends to an archive server and members who joined before February 2024.

At least that’s according to what we know from the investigation so far, and the apparent extent of the breach – so the caveat is that we assume the ongoing investigation won’t reveal anything else has been accessed.

The other important point to remember here is that only the images were accessed, according to Tea, and no personal data relating to members, such as email addresses or phone numbers.

The worrying part about the data that was accessed, though, is that some of it contains official IDs (and selfies) which could potentially be used for identity theft. It’s worth noting here that Tea also clarifies (in an official statement flagged by USA Today) that it no longer requires an official ID for sign-up, and dispensed with that requirement in 2023.

If you joined Tea before February 2024 and provided a government ID for the sign-up process, then the latter could have been exposed. There’s no clear way of knowing that at this point, but it’s safest to assume that your ID (or other images) may have been leaked online.

That means this information could end up in the hands of a bad actor, sadly, but it’s difficult to say whether that will happen for sure, or indeed to know if it does happen.

What you can do for now as an obvious first line of defense is keep an eye on your finances (bank accounts and credit card statements), watching for any irregularities. In all honesty, this is something you should do anyway, as fraud is an ever-present danger these days with a growing number of scams (alongside data breaches like this one).

A further proactive move is to sign up for one of the best credit monitoring services, and the good news is that you can get this for free (from Experian).

What these services do is keep an eye out for your personal details (from, say, a stolen ID) being used online in suspicious circumstances, bringing these incidents to your attention, so you can be aware of anything potentially underhanded before it comes to fruition. There are also full identity theft protection suites out there, too, for a more comprehensive level of protection.

You might also like…

• Keep your identity intact: 5 easy-to-follow tips to avoid identity theft and fraud
• Microsoft promises to crack one of the biggest problems with Windows 11: slow performance
• No, Windows 11 PCs aren’t ‘up to 2.3x faster’ than Windows 10 devices, as Microsoft suggests – here’s why that’s an outlandish claim