Tea app takes messaging system offline after second security issue reported

Audio By Carbonatix

Tea, a dating discussion app that recently suffered a high-profile cybersecurity breach, announced late Monday that some direct messages were also accessed in the incident.

The app — designed to let women safely discuss men they date — rocketed to the top of the U.S. Apple App Store last week but then confirmed on Friday that thousands of selfies and photo IDs of registered users were exposed in a digital security breach.

404 Media was the first to report on this second security issue, citing an independent security researcher who found it was possible for hackers to access messages between users discussing abortions, cheating partners, and phone numbers.

In a statement posted on its social media accounts, Tea said it "recently learned that some direct messages (DMs) were accessed as part of the initial incident."

"Out of an abundance of caution, we have taken the affected system offline," the app said. “At this time, we have found no evidence of access to other parts of our environment.”

It is currently unknown how many messages were left exposed by the vulnerability. Tea said it is “working to identify any users whose personal information was involved and will be offering free identity protection services to those individuals.” The company said Tuesday it will share more information as it becomes available.

Because of the nature of the app — which allows women to anonymously discuss sensitive information about the men they date — users may be particularly vulnerable to malicious actors who try to expose their real-life identities.

Mary Ann Miller, vice president of client experience at identity verification company Prove, said the women who may have had their information compromised should consider making sure they have real-life security precautions in place — such as cameras, locks and “common sense things that you and I think about to be safe and secure in our own home.”

“The average citizen puts more out there in a public-facing view that can put their safety at risk. And I think it’s time for all of us to think about that more carefully,” she said. Companies, meanwhile, “should look for technology that utilizes other forms (besides) IDs to verify an identity" — and only store essential data and discard, securely, verification data that's no longer needed once a person is verified.

Tea has said about 72,000 images were leaked online in the initial incident, including 13,000 images of selfies or selfies featuring a photo identification that users submitted during account verification. Another 59,000 images publicly viewable in the app from posts, comments and direct messages were also accessed without authorization, a spokesperson said last week.

No email addresses or phone numbers were accessed, the company said, and the breach only affects users who signed up before February 2024.