Security researchers at Wizcase recently discovered data leaks and privacy breaches on five separate dating apps that are popular in the US and East Asia. These breaches revealed user data and sensitive information such as names, billing information, phone numbers, profiles, and even private messages. Further research shows that the leaked information was due to publicly exposed Elastisearch servers, MongoDB databases, and AWS buckets. The five sites involved are:
- CatholicSingles, based in the US, leaked information included usernames, email addresses, phone numbers, age, occupation, education, billing addresses, physical profiles, and user payment information.
- Yestiki, another US-based dating app, leaked around 4,300 user records that include users’ real names, phone numbers, GPS location, activity logs, and more.
- Blurry, a South Korean app, exposed 70,000 records via an Elastisearch server which included private messages, Instagram handles, and phone numbers.
- Congdaq/Kongdaq, another South Korean app, exposed 123,000 user records via an Elastisearch server that included sensitive information such as cleartext passwords, gender, dates of birth, and GPS location.
- Charin and Kyunn, two apps based in Japan, leaked around 102 million records from an unprotected Elastisearch server that contains the same type of information as the others.
Analyst Notes
Anyone using these apps is recommended to immediately change their login credentials as soon as possible, and any other applications that share the same login credentials should also be changed. It is also recommended to never use the same login credentials for multiple sites. This can lead to what is known as a credential stuffing attack. A credential stuffing attack is where an attacker uses stolen credentials and attempts to use them on multiple sites. Users should also be vigilant for email phishing attacks—the demographic information stolen is commonly used to craft spam emails that will entice the victim to perform an action designed by the attacker.
To Read More: https://www.hackread.com/5-dating-apps-leak-millions-of-user-data/?web_view=true
https://www.wizcase.com/blog/dating-breaches-research/
