Heyyo dating app leaked users' personal data, photos, location, more

mood · Sep 25, 2019

Heyyo dating app leaked users' personal data, photos, location, more
Exclusive: Another dating app fails to secure production server and puts users at risk
September 25, 2019
https://www.zdnet.com/article/heyyo-dating-app-leaked-users-personal-data-photos-location-data-more/

Online dating app Heyyo has made the same mistake that thousands of companies have made before it -- namely, it left a server exposed on the internet without a password.
This leaky server, an Elasticsearch instance, exposed the personal details, images, location data, phone numbers, and dating preferences for nearly 72,000 users, believed to be the app's entire userbase.
LEAKED INFORMATION
During the time it took us to secure the server, Heyyo's backend leaked some of the most sensitive type of information online. The breadth of the leaked information is staggering, to say the least. Except for private messages, all other Heyyo user data was available on the company's Elasticsearch server.
PRODUCTION SERVER; NOT AN OLD BACKUP
The number of registered users grew from 71,769 to 71,921 in the time we looked at the data. We also registered a test account, and we saw it appear on the server within seconds.

Only an investigation from Heyyo's staff could confirm if this data has fallen in the wrong hands,and if users are in any danger.
Click to expand...

mood · Sep 26, 2019

Blackmail Fears as Data Leak Exposes Dating App Users
September 26, 2019
https://www.infosecurity-magazine.com/news/blackmail-fears-data-leak-exposes/

The 600MB of data contains a trove of sensitive personal information which could be used in follow-on phishing or identity fraud attacks, including: name, email address, country, date of birth, dating history, phone number, occupation, and even a link to social media profiles.
Given the sensitive nature of the dating app, there are also exposed details which could be used to blackmail individuals, such as sexual orientation and preferences. If hackers found users of the app who are already married or in long-term relationships, that could also provide an opportunity to extort money from them.

Automated cloud security tools can be used to detect, alert and remediate misconfigurations like the one affecting Heyyo, according to DivvyCloud CTO, Chris DeRamus.

“Database misconfigurations have proven time and time again to be the Achilles’ heel of many organizations that have suffered data breaches this year, yet there are very simple and highly effective solutions available to prevent this,” he argued.
Click to expand...

Log in or Sign up

Heyyo dating app leaked users' personal data, photos, location, more

mood Updates Team

mood Updates Team