Loading story…
An exposed Firebase database compromised two niche dating platforms operated by the same organization, leaking sensitive user data from Senior Dating and ladies.com. The Senior Dating breach affected about 766,000 users, while ladies.com affected roughly 119,000 users. Exposed records included email addresses, photos, gender, dates of birth, and precise geolocation data; the ladies.com breach also exposed sexual orientation, and Senior Dating records included Facebook account links.
The operator acknowledged the incidents in December 2024 and shut down both services, with ladies.com going offline in mid-2024 and Senior Dating later discontinued alongside it. Both breaches were listed by Have I Been Pwned as sensitive, meaning they are not publicly searchable, reflecting the highly personal nature of the exposed information and the risk posed by the disclosure of intimate profile details and exact latitude and longitude coordinates.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
In December 2024, the site operator acknowledged the data breach affecting Senior Dating and later acknowledged the ladies.com breach as well. The disclosures confirmed the incidents and their connection to the same organization.
The operator shut down ladies.com in mid-2024, and the Senior Dating reference indicates Senior Dating was also later shut down following the breach. Both services were ultimately taken offline in connection with the incidents.
In 2024, exposed Firebase databases led to breaches of two dating sites run by the same organization: Senior Dating and ladies.com. The incidents exposed sensitive user data including email addresses, photos, profile details, dates of birth, and precise location coordinates.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybernews researchers reported multiple **data exposures caused by misconfigured back-end services**, including consumer mobile apps and a large unprotected database. Three widely downloaded Android AI photo identification apps—*Insect Identifier by Photo Cam*, *Dog Breed Identifier Photo Cam*, and *Spider Identifier App by Photo*—reportedly leaked more than **150,000** users’ data via a **Firebase misconfiguration** with inadequate authentication/access controls. Exposed data included email addresses, usernames, profile photos, notification tokens, and **GPS coordinates**; while passwords were not found, researchers noted the location data could enable stalking, doxxing, and targeted scams, and observed indications that automated bots had already discovered the exposed databases prior to the investigation. The apps were attributed to publisher **MobilMinds** (linked to **OZI Technologies**), and the developers reportedly did not respond to requests for comment. Separately, Cybernews identified an **unprotected Elasticsearch cluster** exposing approximately **8.7 billion records** associated with China, including names, birthdates, home addresses, national ID numbers, social media identifiers, usernames, and other account/platform details; the dataset also reportedly contained **plaintext credentials** and corporate/business records, suggesting long-term aggregation. The database’s ownership was not confirmed, but it was subsequently secured; researchers characterized the exposure as a systemic privacy risk potentially affecting hundreds of millions of individuals. Two additional items in the set describe individual bug-hunting writeups (e.g., bypassing mobile controls and abusing password reset/IDOR-style issues) but do not provide verifiable linkage to the specific Firebase/Elasticsearch exposures described above.
Jun 29, 2026
**Match Group** confirmed it is investigating a “recently identified security incident” after **ShinyHunters** claimed to have stolen and leaked data tied to its dating platforms, including **Hinge, Match.com, and OkCupid**. The actor advertised a dump of roughly **1.7 GB** of compressed files and claimed **10+ million records** plus internal documents; Match Group said it moved quickly to terminate unauthorized access and is working with external incident response experts while notifying affected individuals as appropriate. Reporting indicates the intrusion likely stemmed from compromised identity and SaaS access rather than direct compromise of the dating apps themselves. The alleged source of exposure was **AppsFlyer** (a marketing analytics platform), and one account of the incident attributes initial access to a compromised **Okta SSO** account that enabled access to AppsFlyer and cloud storage (including **Google Drive** and **Dropbox**). Match Group stated there is currently **no indication** that **user login credentials, financial information, or private communications** were accessed, while third-party review of samples reportedly suggested the dataset includes personal customer data, some employee details, and internal corporate material.
Jun 29, 2026
DC Health Link and Doxbin were added as sensitive breach incidents after large datasets containing personal information were exposed online. DC Health Link disclosed a breach discovered in March 2023 after data was reportedly posted to a well-known breach forum, exposing about **48,000 unique email addresses** alongside names, genders, dates of birth, home addresses, phone numbers, and **Social Security numbers**; the posting was linked in reporting to **`IntelBroker`**. Doxbin, a doxing website, was also listed for a breach affecting more than **370,000 unique email addresses** after data from January 2022 leaked. The exposed records included account details such as usernames, password hashes, and browser user agents, as well as highly sensitive victim information contained in doxes, including names, physical addresses, and phone numbers. Both incidents were classified as **sensitive**, meaning the compromised data is not publicly searchable through the breach-notification service.
Jun 29, 2026