Massive Tea App data breach exposes 13,000 user photos and IDs in cybersecurity crisis
A major cybersecurity breach has compromised the Tea app, a platform built to provide women with a private and anonymous space to share safety-related experiences with men. The breach exposed tens of thousands of sensitive user images, including 13,000 verification selfies and government-issued photo IDs, sparking alarm among users and digital privacy advocates alike.
A cyberattack on the Tea app leaked 13,000 selfies and IDs, raising urgent concerns about user privacy, app security, and data protection laws.
Jacob Wackerhausen/Getty Images
A spokesperson for Tea confirmed Friday that hackers gained unauthorized access to a database containing approximately 72,000 images. These files include highly sensitive verification materials users are required to submit upon registration, such as real-time selfies and ID documents. The breach reportedly stems from a server containing data stored more than two years ago, which the company claims was originally retained to comply with law enforcement protocols aimed at preventing cyberbullying.
Tea has seen a meteoric rise in popularity, recently topping the Apple App Store’s free download charts. According to the company, nearly 1 million new users joined the app in the past week alone. Designed as a digital “whisper network,” the platform enables women to share feedback about men they have interacted with, using tags such as “green flag” or “red flag” to help others assess potential dating risks.
Verification is central to Tea’s onboarding process. New users must submit selfies to confirm their identity and gender. Though the app previously assured that these images would be deleted after verification, the latest breach has cast doubt on those assurances. Users are also promised anonymity through pseudonymous usernames and are prohibited from taking screenshots within the app.
Cybersecurity experts have been brought in to investigate and contain the breach. In a public statement, Tea emphasized its commitment to data protection: “Safeguarding our users’ privacy is our top priority. We are working tirelessly to enhance our systems and prevent any further exposure.”
Digital vigilante activity and online retaliation appear to have played a role in the incident. Just hours before the leak was confirmed, users on the message board 4Chan launched a coordinated call for a “hack and leak” campaign against the app. Shortly after, a link to the stolen database appeared on both 4Chan and X (formerly Twitter), where images from the breach began to circulate widely.
Hollywood Above has not independently verified the legitimacy of the leaked images, though screenshots suggest some data may include geographic coordinates. A user-created Google Map, circulating online, appears to plot the alleged locations of affected users, though it excludes names and exact addresses.
The app’s founder, Sean Cook, has previously stated that Tea was born from personal motivation after witnessing his mother endure disturbing experiences on dating platforms, including catfishing and interactions with individuals who had concealed criminal records. Tea’s features include the ability to reverse-search images, run background checks, and investigate criminal histories — tools that supporters say empower users with information while critics argue they invite potential misuse.
Tensions around the app have deepened in recent days. Some men online have voiced fears of being unfairly targeted or doxxed, while others have proposed developing a male-centric counter-app. One such attempt, called Teaborn, was swiftly removed from the App Store after users were accused of sharing revenge porn.
Despite the breach, Tea claims its user base continues to grow. The company reported that over 2 million new accounts have been created in the past few days. On social media, however, users have begun to voice apprehension about data privacy. Many are still waiting to be approved from the app’s growing waitlist, and several expressed fears about how their personal data could be weaponized if further security lapses occur.
Tea has pledged to take every necessary measure to fortify its infrastructure and reassure users of its platform's integrity. The company also continues to donate a portion of its proceeds to the National Domestic Violence Hotline, which has confirmed its donor status to various media outlets.
