New breach of women-only app Tea exposes personal chats and phone numbers

Just days after a significant data breach that exposed thousands of user images and personal information, the women-only safety app Tea is facing an even larger scale of data exposure. Along with the leaked user verification images and personal IDs that were misused on platforms like 4Chan, the app’s security flaws have now been found to allow hackers access to private messages between users. An independent security researcher, verified by 404Media, was able to retrieve conversations from a separate database, containing sensitive information such as phone numbers, discussions about intimate relationships, and even conversations about abortion.

Security Vulnerabilities and Response

The researcher, Kasra Rahjerdi, also gained access to backend features of the app, including the ability to send mass push notifications to users’ devices. Tea stated that they are addressing the initial breach and that current user data is secure. They have launched a full investigation with the help of external cybersecurity firms and law enforcement. Despite the app’s recent surge in popularity, stemming from controversies surrounding its purpose, concerns over data privacy were raised before the breach occurred.

Exploitation of Vulnerabilities

Following the initial breach, hackers exploited the app’s vulnerable security system to dox female users by seizing geolocation information stored in the database. This information was used to create a map of Tea users’ locations nationwide. Additionally, personal images were taken from the database to mock users’ appearances on public forums. Some hackers even created copycat apps for men to discuss intimate details of women’s bodies.

The aftermath of this data breach highlights the importance of cybersecurity measures for apps that handle sensitive personal information, especially in the context of platforms that cater to vulnerable populations like women seeking safety online. The incident serves as a reminder of the ongoing challenges in safeguarding user data and privacy in the digital age.