In a striking revelation, researchers have uncovered a severe privacy breach involving approximately 1.5 million user images associated with specialist dating applications. Notably, many of these images contain explicit content, and they have been publicly accessible online without any password protection. This oversight has left users vulnerable to potential hackers and extortionists, raising significant concerns regarding data security and user privacy within the digital dating landscape, specifically in niche communities like BDSM and the LGBTQ+ population.
The vulnerabilities were identified in five dating platforms developed by M.A.D Mobile, namely BDSM People, Chica, Pink, Brish, and Translove. These applications cater to an estimated user base of around 800,000 to 900,000 users, providing avenues for connection among individuals with unique preferences and identities. Alarmingly, users of these platforms believed that their private images and details were secure, yet they were unknowingly exposed to anyone with access to the links that hosted these images.
The timeline for addressing this security flaw is troubling as well. M.A.D Mobile received initial warnings about the security issue on January 20, 2025, but it took a direct email from the BBC—almost three months later—before they acted on correcting the vulnerability. Though M.A.D Mobile has since resolved the security breach, they have not publicly disclosed how such sensitive information was inadequately protected in the first place or why a response took as long as it did.
The discovery was first made by ethical hacker Aras Nazarovas from Cybernews, who utilized his technical skills to analyze the underlying code of the dating apps. His investigation revealed the online storage location, allowing him to access a trove of unprotected images that should have remained confidential. Shocked by the ease of access he had to these explicit and sensitive images without needing a password, Nazarovas expressed his astonishment at the lack of basic security measures.
The images included not only those from public profiles but also private messages and even content that had been flagged and removed by moderators. This extensive range of accessible material exacerbates the risk of exploitation, especially for individuals living in countries where their sexual orientation or lifestyle is subject to discrimination or violence. While the images were not tagged with usernames or real identities, the potential for malicious actors to craft targeted attacks remains a serious threat.
In response to the incident, M.A.D Mobile acknowledged the crucial role of the researcher in uncovering the vulnerability, expressing gratitude for the timely awareness that helped avert a potential massive data breach. They announced impending updates for the affected applications, indicating that they were working to shore up security to prevent any future occurrences.
However, gaps remain in the assurance provided by M.A.D Mobile. They did not elaborate on the potential risks faced by their users or respond to inquiries regarding their operational location or the timeline for rectifying the vulnerability after being notified multiple times. Security researchers, as a standard practice, typically postpone public reports of vulnerabilities until they are resolved, to protect users from being targeted meanwhile. Yet Nazarovas’s team felt compelled to urgently inform the public about the existing hazard for their safety, as they perceived that no effective actions were being taken by M.A.D Mobile.
This incident echoes past experiences in the online dating world, such as the notorious data breach of Ashley Madison in 2015, where sensitive user information was also compromised. The repeated exposure of security shortcomings urges developers of dating platforms to prioritize user safety and privacy, especially in niche markets where vulnerability can carry significant real-world consequences. As the digital landscape continues to evolve, so too must the commitment to robust security measures that safeguard user data and privacy.
