AILSA CHANG, HOST:
So what's the tea? Well, Tea is actually a newish dating app, not for dating exactly, but for women to anonymously share information about men in their dating pool to, say, report bad or dangerous behavior that they've experienced with these specific men. The app got really popular really quickly, which made it quite unpopular with those who felt it invaded their privacy. But the real tea about Tea is that it was just hacked. Last Friday, the company said the data breach exposed tens of thousands of images, including many users' selfies, and the security issues kept growing this week. Joseph Cox is one of the reporters who broke the story. He's co-founder of the website 404 Media. Welcome.
JOSEPH COX: Thank you so much for having me.
CHANG: So I understand that there have been now two separate data breaches. What exactly has happened here?
COX: Yeah, that's right. So the first one happened around Friday. My co-founder, Emanuel Maiberg, got a tip that all of this data from the Tea app was being posted to 4chan, the notorious troll forum which was behind all sorts of harassment of people over years, if not decades now. So we, sure enough, find a bunch of selfies and driver licenses of people posted. We then work to verify that these are actually coming from Tea app users, and I figure out, yes, this data is legitimate.
CHANG: OK. And just to be very clear, these are selfies and driver's licenses of mostly women who have posted on the Tea app about men.
COX: Yeah. So when you use the Tea app, when you go through the sign-up process, you have to take a selfie to prove that you are a woman.
CHANG: And you said in addition to selfies and driver's license images, there are snapshots of chats between the women using this app.
COX: Yes. So we then received another tip that there was essentially a second breach that, in my mind, was actually even more sensitive. A security researcher found it was possible to get essentially every direct message sent across the app. We dug through the content to see how sensitive this was, and I really can't overstate how delicate these messages are. There are women talking about abortions, talking about cheating boyfriends. These are really, really sensitive conversations. But we found it was trivial to unmask many of the women in here because they're exchanging phone numbers 'cause of course they want to find out, well, is my boyfriend cheating on me?
CHANG: Absolutely. And what have people been doing with this information online since it got hacked?
COX: So at the start, on 4chan, people were more just mocking some of the women using the app. But beyond that, some people have even made some sort of ranking website where it will show you two photos of women included in the database, and you are then asked to rank them on perceived attractiveness.
CHANG: You know, I'm thinking about other online platforms because so many are forcing users to share more information about themselves in order to even create an account - like a driver's license, like a selfie - because those platforms are trying to limit spam and fake accounts. But do you think these kinds of steps are actually making people more vulnerable to data breaches?
COX: Yes, absolutely. And I've reported on a data breach at a identity verification company that was hired by companies such as X and TikTok and Uber, and they were breached, and driver's licenses were stolen there as well. So it is really creating a new platform of risk for people when they're simply trying to navigate the World Wide Web.
CHANG: Frightening. Joseph Cox is the co-founder of the website 404 Media. He also hosts "The 404 Media Podcast." Thank you very much.
COX: Thank you so much.
CHANG: And we did reach out to Tea for comment on this story. In a statement, a spokesperson told us that the company has taken the systems accessed by hackers offline while it investigates and is working to provide affected users with free identity protection services.
(SOUNDBITE OF GOTYE SONG, "SOMEBODY THAT I USED TO KNOW") Transcript provided by NPR, Copyright NPR.
NPR transcripts are created on a rush deadline by an NPR contractor. This text may not be in its final form and may be updated or revised in the future. Accuracy and availability may vary. The authoritative record of NPR’s programming is the audio record.
