Dating App Data Breach: What Leaked, and What to Do (2026)

A breach at a dating app is different from a breach at a shoe shop. A leaked email address from a shopping site is spam. A leaked email address from a dating app, attached to a profile, is leverage. For married users it can be the start of an extortion attempt. This piece covers what has actually leaked, what to do if your app is breached, and what to look for so the next breach costs you less.

Ashley Madison, 2015: the breach that set the template

In July 2015 a group calling itself The Impact Team announced it had taken Ashley Madison's user data and demanded the site shut down. It released a small sample, then dumps totalling more than 60 GB over 18–20 August 2015 (Wikipedia). The US Federal Trade Commission says hackers published profile, account-security and billing information for more than 36 million users. In December 2016 the operators settled FTC and state charges — brought with 13 states and the District of Columbia — for a total of $1.6 million and agreed to a comprehensive data-security programme. The FTC complaint said the company had no written information-security policy and no reasonable access controls (FTC).

Three details from that breach still matter:

• The "delete" did not delete. Users had been charged $19 to remove their profiles, but the leaked data included people who had paid for exactly that (Wikipedia).
• Extortion followed within days. People in the dump received blackmail demands, and on 24 August 2015 Toronto police said two unconfirmed suicides had been linked to the breach (same source).
• It dragged on for years. In July 2017 the parent company agreed to pay $11.2 million to settle a class action (Wikipedia).

We wrote separately about Ashley Madison as a service: Ashley Madison in India.

2026: Match Group, and an alleged Bumble breach

Match Group (January 2026) — confirmed incident

On 29 January 2026 BleepingComputer reported that the ShinyHunters group claimed to have leaked about 10 million records from Hinge, Match and OkCupid, which it said were mostly tracking data. Match Group, which also owns Tinder, confirmed an incident affecting "a limited amount of user data", said it had terminated the unauthorised access, and said there was no indication that log-in credentials, financial information or private communications were accessed. The reported entry point was a voice-phishing attack on a staff single sign-on account, leading into a marketing-analytics tool.

The lesson: you can have a strong password and still be in a breach, because the weak point was an employee login and a third-party analytics service.

Bumble (January 2026) — alleged, in a lawsuit

A US class action filed on 19 February 2026 alleges that the ShinyHunters group obtained more than 30 GB of Bumble files in January 2026 through a phishing attack, including names, dates of birth, Social Security numbers and dating preferences (ClassAction.org). These are claims in a complaint, not findings. The report we checked contains no response from Bumble, and we have not seen the scope confirmed by the company.

If your dating app is breached: what to do

1. Change the password for that app, and anywhere else you used the same one. Then turn on two-factor authentication on your email — your email is the key to every other account.
2. Check which of your addresses have appeared in known breaches at Have I Been Pwned. It tells you which breaches included your email, so you know what an attacker might have.
3. Expect phishing. After a breach, fake "your account is suspended — verify here" emails and texts follow. Do not click links; go to the app directly.
4. Watch for extortion, and do not pay. Mass emails claiming "we know you used X" are common after a breach and usually hold nothing more than the leaked data. Paying marks you as someone who pays. Keep the message as evidence.
5. Report threats. National Cybercrime Helpline 1930 or cybercrime.gov.in. Extortion is an offence under Section 308 of the Bharatiya Nyaya Sanhita. Step-by-step guide: being blackmailed — what to do (Hindi: ब्लैकमेल हो तो क्या करें).
6. Remember the legal position. Using a dating app while married is not a crime in India; the Supreme Court struck down the adultery offence in Joseph Shine v. Union of India (2018). A blackmailer's leverage is social, not legal.

What Indian law will require of apps

Section 8(6) of the Digital Personal Data Protection Act, 2023, requires a company to inform the Data Protection Board and each affected person of a personal data breach (Section 8 text). Rule 7 of the DPDP Rules, 2025, sets out how: affected users must be told "without delay" in plain language what happened, the likely consequences and what they can do, and the Board must receive a detailed report within 72 hours (Rule 7 text). Most of the Act's operative provisions are scheduled to take effect on 13 May 2027 (MediaNama). Until then, do not assume you will be told.

5 lessons for choosing a discreet app

1. The data that cannot leak is the data never collected. Prefer apps that do not display or store your real name on your profile, do not need your card, and do not ask for your contacts.
2. Deletion must be real and free. Ashley Madison's paid delete is the warning. Read what the privacy policy keeps after deletion.
3. Photos should not be public. A face in a leaked photo set is identifiable forever; a masked photo that only a match sees exposes you to far fewer people.
4. Chat should stay in the app. Phone numbers and WhatsApp chats end up in more places than any app database.
5. No payment is the smallest payment trail. Billing records were part of the 2015 leak.

Parda was built around these: it is free, with no card on file; photos are masked server-side until you match; phone numbers, emails and handles are stripped from chat; and no real names are shown — your legal name is used once for the human-reviewed ID check. No app can promise it will never be breached, including ours; what an app can control is how little there is to take. More in our privacy page and are extramarital dating apps safe?