Image by Kev Costello, from Unsplash
Tea App Breach Exposes 1.1M Private Messages in Second Major Security Flaw
Reading time: 2 min
Last Updated: Jul 29, 2025
-
![Kiara Fabbri]()
-
![Sarah Frazier]()
Fact-Checked by Sarah Frazier Content Manager
Tea, the women’s dating app, suffered its second data breach, revealing over one million private messages containing personal details.
In a rush? Here are the quick facts:
- Tea app’s second breach exposed 1.1 million private user messages.
- Sensitive chats include discussions on cheating, abortions, and phone numbers.
- Real identities were easy to uncover despite anonymous usernames.
This new breach exposed 1.1 million private messages between users, which revealed conversations about cheating partners, abortions, and personal details including phone numbers.
The independent researcher Kasra Rahjerdi discovered this issue, which 404Media then reviewed and verified the data.
Unlike the first breach, which involved an old Firebase database, this latest exposure involved a newer database and included messages as recent as last week. According to Rahjerdi, the flaw allowed any Tea user to use their API key to access the private chats.
“It’s hard to overstate how sensitive this data is and how it could put Tea’s users at risk if it fell into the wrong hands,” 404 Media wrote.
The anonymity feature on Tea did not protect users, since it was fairly simple to reveal their identities through their message content, such as sharing names, social media profiles, and phone numbers.
Some conversations include women discovering they’re dating the same man, others discuss abortions, or identify cheating partners by describing their cars. “I am his wife,” one message says. In another, a woman warns others about her fiancé.
Tea, which has over 1.6 million users and recently topped the App Store, says it has launched an investigation and contacted law enforcement. “We are continuing to work expeditiously to contain the incident and have launched a full investigation with assistance from external cybersecurity firms,” a spokesperson told 404 Media.
The issue persisted until late last week, according to the researcher.
Previous Story
Latest articles 
