Match Group Data Breach Exposes User Information from Hinge, Tinder, and OkCupid
- Securityish
- Threats & Incidents
Quick Summary
Match Group, the parent company of popular dating platforms like Tinder, Hinge, and OkCupid, confirmed a data breach involving a limited amount of user data. The ShinyHunters threat group leaked 1.7 GB of files containing approximately 10 million records. Although the breach did not compromise login credentials or financial information, it raises significant concerns about user privacy and the effectiveness of current cybersecurity measures.
The Securityish Brief
Match Group, which operates several well-known dating services including Tinder, Match.com, Meetic, OkCupid, and Hinge, recently experienced a cybersecurity incident. Hackers from the ShinyHunters group leaked 1.7 GB of compressed files that allegedly contain around 10 million records of user information from Hinge, Match, and OkCupid, along with some internal documents. The breach was confirmed by a spokesperson for Match Group, who stated that the company is investigating the incident with external experts.
The breach was attributed to a social engineering attack that compromised an Okta single sign-on (SSO) account. This unauthorized access allowed the attackers to infiltrate the company’s AppsFlyer marketing analytics instance and access Google Drive and Dropbox cloud storage accounts. While Match Group believes that the incident affects a limited amount of user data, they are in the process of notifying impacted individuals.
Implications for Users and Organizations
This incident highlights the ongoing risks associated with social engineering attacks, particularly those targeting SSO accounts. The hackers reportedly accessed data that includes personally identifiable information (PII), although the company asserts that the data primarily consists of tracking information. This breach underscores the importance of implementing robust security measures to protect user data.
Experts recommend that organizations adopt phishing-resistant multi-factor authentication (MFA) solutions, such as FIDO2 security keys or passkeys, to mitigate risks associated with social engineering. Charles Carmakal, Mandiant’s Chief Technology Officer, emphasized that these protections are more effective than traditional SMS authentication methods.
Additionally, administrators should enforce strict app authorization policies and monitor logs for any unusual API activity or unauthorized device enrollments. Okta has also advised organizations to enroll users in Okta FastPass or passkeys to enhance security against phishing attempts.
As the threat landscape evolves, organizations must remain vigilant and proactive in their cybersecurity strategies to safeguard sensitive user information and maintain trust.
- Tinder – A popular dating app owned by Match Group that allows users to connect with potential matches.
- Match.com – One of the oldest dating platforms, also owned by Match Group, offering various features for users to find partners.
- Meetic – A dating service in Europe under Match Group, catering to users looking for relationships.
- OkCupid – A dating platform that uses a unique questionnaire to match users based on compatibility, also part of Match Group.
- Hinge – A dating app designed to be deleted, focusing on serious relationships, owned by Match Group.
Key Takeaways
- Review your account security settings on dating platforms and enable multi-factor authentication where available.
- Be cautious of unsolicited communications requesting personal information or login details, especially from unknown sources.
- Monitor your accounts for any unusual activity or unauthorized access attempts.
- Consider using phishing-resistant MFA solutions, such as FIDO2 security keys, for enhanced protection.
- Stay informed about the latest cybersecurity threats and best practices to safeguard your personal information.
Key Terms & Concepts
- ShinyHunters: In this article, ShinyHunters refers to a threat group known for conducting data breaches and leaking sensitive information.
- social engineering: Social engineering is a tactic used by attackers to manipulate individuals into divulging confidential information.
- multi-factor authentication (MFA): MFA is a security measure that requires users to provide two or more verification factors to gain access to an account.
- Okta: Okta is an identity and access management service that provides single sign-on and multi-factor authentication solutions.
- personally identifiable information (PII): PII refers to any data that could potentially identify a specific individual, such as names or email addresses.
Read the original article here: https://www.bleepingcomputer.com/news/security/match-group-breach-exposes-data-from-hinge-tinder-okcupid-and-match/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
