This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
The Tea dating app, which utilized AI for user verification and reverse image search, suffered a major data breach of a legacy storage system. Approximately 72,000 images, including selfies and government IDs, were accessed by hackers and leaked on 4chan. This incident exposed users to potential harassment and safety risks, leading to class action lawsuits against the company.
In July 2025, the Tea dating advice app, which purportedly uses AI-assisted tools for user verification and reverse image search, reportedly suffered a breach of a legacy storage system. Hackers allegedly accessed about 72,000 images, including selfies, photo IDs, and other content, which were purportedly circulated on 4chan. The incident reportedly exposed sensitive data of users who signed up before February 2024.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
AI systems that memorize and leak sensitive personal data or infer private information about individuals without their consent. Unexpected or unauthorized sharing of data and information can compromise user expectation of privacy, assist identity theft, or cause loss of confidential intellectual property.
The incident involved the unauthorized access and leaking of highly sensitive personal information, including government IDs and selfies used for AI-based verification, directly violating user privacy.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The data breach was caused by human hackers intentionally targeting the app's legacy storage system post-deployment, combined with human management decisions regarding data retention.
Added categories peak at 3: Substantial (Psychological Harm, Inferred)
A data breach of the Tea dating app exposed 72,000 images, including government IDs and selfies used for AI-based verification. The leaked data was posted on 4chan, leading to targeted harassment and doxxing. The incident represents a minor national security concern, primarily impacting individual privacy and highlighting security risks of retaining sensitive verification data.
The AI system in the Tea app performed specific, well-defined functions such as reverse image searching and user verification based on direct photo inputs, operating as a Tool.
Minimal or No Risk: The report describes an AI system used for user verification and reverse image search in a commercial dating app, which poses minimal risk to users under normal operation.
The AI was primarily used to verify user identities using selfies and photo IDs (Image Verification) and to perform reverse image searches to detect catfishing.
The reports provide clear and consistent details about the data breach, the number of images exposed, the platform involved, and the subsequent consequences such as lawsuits and online harassment. The role of AI (verification and reverse image search) is clearly contextualized within the app's features.
The incident could be viewed purely as a cybersecurity failure of a legacy database rather than an AI safety failure, though the data leaked was collected specifically for the AI verification process.
Technology
Vulnerable Legacy Storage System
Data stored in older, less secure systems that were not properly fortified.
Exposed Image Metadata
Metadata left in images allowed malicious actors to map user locations.
Automated Reverse Image Search
Image-matching automation features exposed sensitive user profile photos.
Data Inputs
Retention of Verification Selfies
Selfies and IDs were kept instead of being deleted after verification.
Collection of Sensitive IDs
Requiring government IDs created a high-value target database for hackers.
Unfiltered Direct Message Logs
DMs containing personal conversations were stored and subsequently leaked.
Human Factors
Targeting by Malicious Trolls
4chan users coordinated attacks to hack the app and leak data.
User Reliance on App Security
Users uploaded sensitive IDs trusting the app safety promises.
Online Mob Behavior and Gossip
Digital whisper networks amplified toxic behavior and bad-faith claims.
Process and Methods
Failure to Delete Verified Data
Retention policy conflicted with the promise to delete verification data.
Inadequate Data Migration
Legacy systems were excluded from security upgrades applied to new systems.
Lack of Metadata Stripping
No process to strip EXIF location data from uploaded user images.
Management
Prioritizing Growth Over Safety
Rapid scaling to millions of users outpaced safety infrastructure.
Inadequate Risk Assessment
Management failed to secure legacy databases holding user IDs.
Conflicting Privacy Policies
Stated deletion policies conflicted with actual data retention practices.
Regulatory Environment
Cyberbullying Retention Laws
Law enforcement requirements led to keeping data that should be deleted.
Lack of Data Privacy Oversight
Absence of strict regulatory oversight on sensitive ID storage.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
