Bumble Faces Class Action Over Alleged 2026 Data Breach Exposing Sensitive User Information A newly filed class action lawsuit in the Western District of Texas targets Bumble, Inc., alleging a "massive and preventable" cyberattack in or around January 2026 that compromised highly sensitive user data. The breach reportedly exposed personal details, including names, dates of birth, addresses, phone numbers, Social Security numbers, and account information, as well as intimate dating data such as chat and dating history posing heightened risks of identity theft and privacy violations. The complaint, brought by a named plaintiff seeking damages and injunctive relief, claims the breach resulted from a phishing attack attributed to the ShinyHunters threat actor group. It alleges multiple security failures, including inadequate employee training, lack of organization-wide two-factor authentication, insufficient data encryption, delayed breach detection, and untimely notification to affected users. Central to the lawsuit are allegations that Bumble’s public privacy policy promised "appropriate and reasonable security measures," such as secured servers and firewalls, but failed to implement them. The case underscores how misalignment between stated security commitments and operational practices can become key legal vulnerabilities in the aftermath of a breach. The outcome may serve as a precedent for how companies are held accountable for both technical safeguards and policy adherence in cybersecurity incidents.