Loading story…
Grindr agreed to pay £26 million (about $35 million) to settle a UK group action alleging it unlawfully processed and shared sensitive information from users of its free app with third parties before 2020. The claims, brought by law firm Austen Hays on behalf of roughly 12,000 users, concerned data including HIV status, PrEP use, sexual orientation, ethnicity, sex-life information, location, and mental-health details allegedly used for commercial and advertising purposes without adequate consent.
The settlement, reached on September 2 and subsequently disclosed in an SEC filing, does not include an admission or finding of liability. Grindr said the disputed practices occurred while the company was owned and controlled by Kunlun, and said it overhauled its privacy program in 2020. It will pay two £13 million installments by December 31, 2026, and March 31, 2027; the case follows prior UK and Norwegian regulatory scrutiny of Grindr's privacy disclosures and third-party data sharing.
See the reporting duties and controls this puts on the clock.
10 events from the most recent confirmed update back to the earliest known activity.
Grindr disclosed the UK settlement to investors in a US Securities and Exchange Commission filing two days after reaching the agreement.
Grindr agreed to pay £26 million to settle the UK group action over alleged pre-2020 sharing of sensitive data, including HIV-related information. The settlement included no finding or admission of liability, and Grindr continued to dispute the allegations.
Norway's court of appeal upheld the reduced fine imposed on Grindr in the Norwegian GDPR case.
Grindr said it was served with proceedings in the UK group privacy action filed by Austen Hays.
Law firm Austen Hays filed a High Court of England and Wales group action alleging that Grindr shared sensitive user data with third parties without adequate consent. The action concerned free-app users between 2016 and 2020 and represented approximately 12,000 claimants.
The Oslo District Court upheld the Norwegian data-protection penalty against Grindr after the company challenged it.
The UK Information Commissioner's Office reprimanded Grindr for failing to provide UK users with effective and transparent privacy information.
Norway's data protection authority fined Grindr for GDPR violations involving sharing personal data with advertisers without a legal basis. The case concerned data including location, sexual orientation, and mental-health details.
Chinese gaming company Kunlun sold Grindr to San Vicente Acquisition LLC. Grindr later said it overhauled its privacy program following the change in ownership.
Norwegian nonprofit research group SINTEF reported that Grindr shared users' HIV status and last-tested date with app-optimization providers Apptimize and Localytics. Grindr subsequently said it would stop the identified sharing practice.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
8 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcetherecord.media
Open sourcemalware.news
Open sourceinfosecurity-magazine.com
Open sourcethehackernews.com
Open sourcetheguardian.com
Open sourceaustenhays.com
Open sourcesec.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google agreed to a preliminary **$135 million** class action settlement in *Taylor v. Google LLC* over allegations that Android devices transmitted cellular data to Google without users’ consent, including while phones were idle and apps were closed. The proposed settlement covers roughly **100 million U.S. Android users** who used an Android device with a cellular data plan from **Nov. 12, 2017** until final approval, though Google denied wrongdoing and said it settled to avoid further litigation. Eligible users can file claims for payments that may reach **up to $100**, with final amounts depending on participation levels and deductions for fees and costs. As part of the agreement, Google will revise Google Play terms to better disclose passive data transfers, obtain user consent during device setup, and stop collecting data entirely when the **"allow background data usage"** setting is turned off. A final approval hearing is scheduled for **June 23**, and payments would be issued only after court approval and any appeals are resolved.
Jun 29, 2026
Comcast agreed to pay **$117.5M** to settle a class action tied to a large-scale breach disclosed in late 2023 that potentially affected **31M+** people. Comcast attributed the intrusion to **CitrixBleed** (Citrix NetScaler ADC/Gateway), a vulnerability that can enable **session hijacking** and credential theft; researchers warned stolen session tokens could remain valid even after patching, extending attacker access. The proposed settlement (preliminarily approved) provides reimbursement for documented losses (up to **$10,000** per person) and compensation for time spent responding, while Comcast denies wrongdoing. Separately, Google agreed to pay **$135M** to settle Android users’ claims that devices transmitted data to Google servers over **cellular networks** in the background without meaningful consent, with individual payouts capped (reported up to **$100**) and additional **injunctive relief** requiring clearer disclosures and express consent during setup. Two dermatology practices also reached settlements over cybersecurity incidents exposing patient data; one New Jersey practice reported unauthorized network access spanning **Dec 2023–Mar 2024** and exposure of **PHI/PII** (including SSNs and treatment/insurance data) affecting **373,630** individuals, offering cash benefits plus credit monitoring/identity protection while denying liability.
Jun 29, 2026
UK regulators issued major penalties against online services for inadequate **age assurance** controls intended to protect children. The Information Commissioner’s Office (**ICO**) fined **Reddit £14.47 million** for unlawfully processing children’s data, alleging that despite a stated under-13 prohibition, Reddit did not introduce an age assurance mechanism until **July 2025** and had not completed a required **data protection impact assessment (DPIA)** before **January 2025**. The ICO said these failures potentially exposed minors to inappropriate content and left under-13 users’ personal data collected and used without a lawful basis; Reddit said it intends to appeal. Separately, communications regulator **Ofcom** fined porn operator **8579 LLC £1.35 million** under the UK **Online Safety Act** for failing to deploy “highly effective” age checks (e.g., photo ID matching or credit card checks) to prevent minors from accessing adult content. Ofcom also imposed an additional **£50,000** penalty for allegedly ignoring information requests and warned of an ongoing **£1,000/day** penalty until compliant age verification is implemented, amid broader concerns from civil liberties groups about the privacy and cybersecurity risks of stringent age-verification regimes.
Jun 29, 2026