Dating App Data Breach: What Leaked and a Privacy Checklist

Every dating app will eventually lose some data, through a hacker, a phished employee or a careless vendor. What you control is how much of you is in there when it happens. Ten minutes with an app's sign-up screens, settings and privacy policy, before you create a profile, decides most of that.

Below: what actually leaked in the three breaches people still ask about, how to check whether your own account was caught in one, and a ten-point privacy checklist to run before you sign up anywhere.

Ashley Madison, 2015: the breach that set the template

On 19 July 2015 a group calling itself The Impact Team announced it had taken Ashley Madison's user data. More than 60 GB was released on 18 August 2015, with a further dump on 20 August (Wikipedia). According to the US Federal Trade Commission, profile, account-security and billing information for more than 36 million users was published.

The FTC's complaint is a useful list of what not to do. The operators allegedly had no written information-security policy, no reasonable access controls, inadequate staff training, and no checks on whether third-party providers were secure; intruders got into the network several times between November 2014 and June 2015 without being noticed. In December 2016 the operators settled with the FTC, 13 states and the District of Columbia for a total of $1.6 million (FTC).

Three things from that breach still matter:

• "Delete" did not delete. The FTC says customers who paid $19 for a "Full Delete" of their data had it retained anyway, and it was in the leak.
• Extortion followed within days. Extortionists began targeting people in the dump, demanding Bitcoin, and at least one company sent letters threatening exposure unless people paid (Wikipedia).
• It ran for years. In July 2017 the parent company agreed to pay $11.2 million to settle about two dozen lawsuits arising from the breach.

We look at the service itself in Ashley Madison in India.

2026: Match Group and Bumble

In late January 2026 the extortion group ShinyHunters claimed separate attacks on Match Group and Bumble. The two companies described very different incidents, and this page originally got some of the detail wrong. Here is what the reports we rechecked actually say.

Match Group: a confirmed incident, scope unclear

ShinyHunters claimed on its leak site to have taken more than 10 million records, plus hundreds of internal documents, from Hinge, Match.com and OkCupid. teiss put the claim at 1.7 GB of compressed data. Match Group confirmed a security incident that it believes "affects a limited amount of user data", said it was notifying affected users, and said there was no indication that login credentials, financial information or private communications were accessed. It declined to say which types of data were taken or how many users were affected (The Register, 29 January 2026).

How the attackers got in has not been confirmed. The leak-site listing pointed to AppsFlyer, a marketing-analytics provider, as the source; The Register noted that this was not confirmed. Researchers at Cybernews who reviewed samples reported personal customer data, some employee details and internal records, including one Hinge-linked sample of about 100 matched users' profile records with names and bios (The Record, 30 January 2026). The 10 million figure is the attackers' claim and has not been independently verified.

The lesson is the one Ashley Madison taught: a strong password does not protect you if the weak point is a company system or a vendor you never knew existed.

Bumble: internal files, says the company; much more, says a lawsuit

ShinyHunters claimed about 30 GB of compressed files from Bumble, pulled mainly from Google Drive and Slack, including internal documents marked restricted or confidential. Bumble said a contractor's account had been compromised in a phishing attack, giving "brief unauthorized access to a small portion of its network", that the access had ended, and that it did not affect its member database, user accounts, the Bumble app, private messages or dating profiles. It informed law enforcement (The Record; teiss, 3 February 2026).

A US class action filed on 19 February 2026 tells a different story. It alleges that more than 30 GB was taken in a January 2026 phishing attack and that the data included names, dates of birth, Social Security numbers and dating preferences (ClassAction.org). These are claims in a complaint, not findings, and they conflict with the company's statement. Until a court or regulator settles it, both versions are unproven.

How to check if your account was in a breach

1. Search your email on Have I Been Pwned. It lists the known breaches that included your address. Search every email you have used for dating, not just your main one.
2. Verify your address to see "sensitive" breaches. For breaches where simply being a member could harm someone, such as Ashley Madison, the site does not show results in a public search. Its FAQ explains that only the verified owner of an address can see them, after confirming they can receive mail at it.
3. Turn on "Notify Me" so you are emailed if the address turns up in a future breach.
4. Check your passwords with the site's Pwned Passwords tool, which hashes and anonymises a password before it is checked. Any password that shows up should be changed everywhere you used it.
5. Read the app's own emails and blog, but reach them by opening the app or typing the address yourself. Breach news is followed by fake "verify your account" messages.
6. Look at what was in that breach, not just whether you were in it. An email address alone means spam and phishing; a profile, photos or billing record means you should prepare for an extortion attempt.

If you were in one

• Change the password for that app and anywhere you reused it, and turn on two-factor authentication on your email first; your email resets everything else.
• Expect phishing, and do not click links in "security" messages.
• If someone writes "we know you used X, pay or we tell your family", do not pay. Mass emails like this are common after a breach and usually hold nothing beyond the leaked data. Keep the message and report it on 1930 or cybercrime.gov.in. Extortion is an offence under Section 308 of the Bharatiya Nyaya Sanhita. Step by step: what to do if you are being blackmailed.
• Remember the legal position: using a dating app while married is not a crime in India. The Supreme Court struck down the adultery offence in Joseph Shine v. Union of India (2018). A blackmailer's leverage is social, not legal.

Privacy checklist before you sign up

Run through this before you create a profile on any dating app. Each answer is in the sign-up screens, the settings, or the privacy policy.

1. What does sign-up ask for? Count the fields. Real name, phone number, date of birth, employer, social login: each one is something that can leak. If the app wants more than it needs to show you matches, ask why.
2. Phone number and contact sync. Does it need your number? Does it ask to read your contacts or "find friends"? Contact access can tie your profile to everyone you know. Say no.
3. Who sees your photos, and when? Can anyone browsing see your face, or only people you have matched with? A public, unblurred face is identifiable to every user and to anyone who scrapes the app.
4. Does chat block numbers and handles? Apps that stop phone numbers and social handles being swapped in the first messages slow down the move to WhatsApp, where most scams play out.
5. Can you delete, for free, and is it real? Find the delete-account option before you join. Read what the privacy policy says it keeps after deletion and for how long. Ashley Madison charged $19 to delete and kept the data anyway.
6. Can you download your data? An export option tells you what the app actually holds about you.
7. Where do ID documents and selfies go? If the app verifies identity, the policy should say who processes the ID (often an outside vendor), what is stored, and how long it is kept. If it does not say, assume indefinitely.
8. A strong, unique password and 2FA. Use a password manager to generate a password you use nowhere else, and turn on two-factor authentication if the app offers it.
9. A separate email. Use an address that is not linked to your office, your social media or your family's devices, and check it on Have I Been Pwned now and then.
10. App permissions. On your phone, check what the app can reach: location (set to "while using", or approximate), camera, microphone, photos (pick selected photos, not the whole gallery), contacts (no).

Two more habits cost nothing: do not reuse photos that appear on your public Instagram or LinkedIn, since a reverse image search links them straight back to you, and do not pay with a card if the app works without one, because billing records were part of the 2015 leak.

What Indian law requires, and when

The Digital Personal Data Protection Act, 2023 requires a company that suffers a personal data breach to inform both the Data Protection Board and each affected person, under Section 8(6). Section 8(7) requires it to erase your data when you withdraw consent or the purpose is no longer served, unless another law requires it to be kept (Section 8 text).

The government notified the DPDP Rules, 2025 on 14 November 2025, with an eighteen-month period for phased compliance, according to the Press Information Bureau. Under Rule 7, affected users must be told "without delay", in plain language, what happened, the likely consequences and what they can do; the Board must get a detailed report within 72 hours (Rule 7 text). The Rules also let you ask for access, correction and, in some situations, erasure of your data, with companies required to respond within ninety days (PIB). Most of these duties, breach notification included, are in the eighteen-month phase, so they do not bind apps until about May 2027. Until then, do not count on being told.

For how other Indian rules apply to dating apps, see are dating apps legal in India. For the scams that often follow a leak, see dating app scams in India.

How Parda answers the checklist

We used the same checklist to build Parda. Sign-up is an email, a password and a nickname: no phone number and no real name. It is free, with no card on file. Photos stay masked until you match, and phone numbers, emails and handles are stripped from chat. Every profile passes a live camera selfie reviewed by a person; the selfie is never shown to other members, and the government ID check is optional. No app can promise it will never be breached, including ours. What an app can control is how little there is to take. Details are on our privacy page.

Quick answers

How do I check if my dating app account was in a data breach?

Search each email you used on haveibeenpwned.com. For sensitive breaches such as Ashley Madison, you must verify that you own the address before results are shown.

Did the 2026 Match Group breach expose private messages?

Match Group said there was no indication that login credentials, financial information or private communications were accessed. The attackers claimed about 10 million records; that figure has not been independently verified.

Was Bumble hacked in 2026?

Bumble said a contractor's account was phished, giving brief access to a small part of its network, and that its member database, private messages and profiles were not affected. A US class action filed in February 2026 alleges more sensitive data was taken; those claims are unproven.

What should I check before joining a dating app?

What sign-up asks for, contact and phone access, who can see your photos, whether chat blocks numbers, how deletion works, where ID documents go, and the app's phone permissions. Use a separate email and a unique password with 2FA.

Does Indian law make dating apps tell me about a breach?

Yes, under Section 8(6) of the DPDP Act, 2023, but the detailed breach rules are part of an eighteen-month phase that began on 14 November 2025, so they apply from about May 2027.