Tea App Breach (July 2025): What Happened and Lessons

The Tea app breach in July 2025 exposed about 72,000 images, including around 13,000 selfies and photo IDs that women had uploaded to verify their accounts. The cause was not a clever hack. The files sat in an old storage system that was left open to the internet.

Tea is a US app where women share warnings and reviews about men they date. It promised a safe, women-only space, which is why the leak hurt so much.

What happened in the Tea app breach

In late July 2025, a user on the forum 4chan posted that Tea's storage was open and shared a way to download it. Tea then confirmed the incident.

According to Tea's official statement:

• About 72,000 images were accessed.
• About 13,000 were verification selfies and photo IDs.
• About 59,000 were images from posts, comments and direct messages.
• The data came from a legacy (old) storage system, holding data from users who signed up before February 2024.

Reports describe it as a Firebase storage bucket. Firebase is Google's popular backend service for apps. A storage bucket is an online folder. If its access rules are wrong, anyone with the address can read it.

It got worse

Soon after, stolen driver's licence photos were shared on a cybercriminal forum, according to The Record.

A second problem then came to light: private messages between users were also exposed. Tea shut down its messaging feature in response. Reports differ on exactly how many messages were involved, so I'm not quoting a number.

Some of the leaked ID photos also kept their EXIF data. That is hidden information inside a photo file, which can include the GPS location where it was taken.

Why this matters beyond one app

Photo IDs and selfies are some of the most dangerous data to lose. You can change a password. You can't change your face or your IC number.

With this kind of data, attackers can:

• Open accounts or loans in someone's name.
• Pass other apps' "selfie plus ID" checks.
• Find, harass or stalk people, especially if location data is attached.

For a Malaysian business, think of any app that asks for a MyKad photo for eKYC (electronic know-your-customer checks): fintech apps, e-wallets, rental platforms, even event ticketing.

The privacy lessons

1. Don't keep what you don't need

Tea's statement said it kept the old images in part to meet requirements around cyberbullying investigations. Whatever the reason, data that does not exist can't leak.

• Verify the ID, record that it passed, then delete the image.
• Set automatic deletion dates for sensitive files.
• Under Malaysia's PDPA, personal data should not be kept longer than needed for its purpose.

2. Check cloud storage rules, especially for old systems

The leak came from a legacy system. Old buckets and test databases are easy to forget.

• List every storage bucket and database you own, including old ones.
• Make sure none allow public read access unless they truly must.
• Use your cloud provider's tools that flag public buckets.

See our cloud-native security best practices for more on this.

3. Strip metadata from uploads

Remove EXIF location data from photos when users upload them. Most image libraries can do this in a line or two of code.

4. Encrypt sensitive files and limit who can see them

ID images should be encrypted and readable only by the verification service, not by every part of the app.

5. Test before attackers do

A simple security review or penetration test (a paid, friendly hacking attempt) would likely have found an open bucket. If your app grows fast, your security checks need to keep up.

6. Have a breach plan ready

When it happens, you need to know who to tell and how fast. Since 1 June 2025, Malaysia's amended PDPA requires data controllers to notify the Personal Data Protection Commissioner of personal data breaches, and affected people where significant harm is likely. Our data breach guide covers response steps in detail.

What users can do

If you've uploaded an ID to any app:

• Watch for loan or account applications you didn't make.
• Be wary of messages that mention your personal details to seem real.
• Ask the app how long it keeps your ID, and request deletion if you stop using it.

My view: the Tea app breach is a reminder that "safety" features can create new risks. If you collect IDs and faces, protecting them is the product, not an extra.

Quick answers

What was exposed in the Tea app breach?

Tea said about 72,000 images were accessed, including about 13,000 verification selfies and photo IDs. Private messages were also exposed in a second issue.

How did the Tea app get hacked?

Data was stored in an old, unsecured cloud storage system that could be accessed without proper permissions. A 4chan user found it and shared how to download it.

Who was affected?

Tea said the image leak affected users who signed up before February 2024.

How can apps avoid a breach like Tea's?

Delete ID images after verification, lock down cloud storage, strip photo metadata and test security regularly, especially old systems.