Field Notes

event

Tea app data breach

StatusStableReviewdue UpdatedStands on3 sourcesSupportsnotes

Tea is a women-only app for sharing safety information about men, a commercialized whisper network that verified new users with selfie and identity photos. In July 2025 two failures in one week turned that safety infrastructure into targeting data.

A legacy cloud storage bucket was left publicly accessible and its contents were posted to 4chan: about 72,000 images, including roughly 13,000 verification selfies and government-ID photos from users who signed up before February 2024, plus about 59,000 images from posts, comments, and direct messages. A second flaw exposed about 1.1 million direct messages spanning early 2023 through July 2025, including conversations about abortions, infidelity, and contact details.

The verification archive did the most damage. The exposed selfies and IDs identified exactly the users who had joined the app to stay safe from specific men, and the leaked material was immediately used for mocking, doxxing, and attempted identification. At least ten lawsuits followed, including consolidated federal class actions and Illinois BIPA claims over the collection of verification selfies.

The incident matters in Case for privacy and security because a safety product concentrates precisely the data whose exposure endangers its users, and because verification artifacts retained after their purpose ends become a standing archive of identity photographs that no later deletion promise can recall.

Built on 3 sources (3 external).

Working out connections…