Grindr Investigates Alleged Data Breach After Hacker Claims to Sell 15M User Records A hacker operating under the alias nilojeda has claimed to breach Grindr’s entire customer database, offering over 15 million user records for sale on an underground forum. The alleged dataset includes sensitive information such as usernames, display names, full names, emails, password hashes, phone hashes, gender and sexual orientation details, and dates of birth. The hacker posted the offer on June 2, pricing the data at $400 in cryptocurrency and providing a sample for verification. Grindr, however, has denied any evidence of unauthorized access. A company spokesperson stated that their investigation found no credible proof of a breach, adding that the legitimacy of the claim remains unclear. The app, which serves nearly 15 million active users across 190 countries, is headquartered in West Hollywood, the Bay Area, Chicago, and New York. The threat actor, nilojeda, first appeared on the forum on May 29 and has also claimed breaches of Hinge’s database and a collection of Spanish contacts. Grindr, a widely used dating platform within the queer community, continues to assess the situation as security researchers monitor the claims.

Grindr,  one of the world’s largest dating and social networking apps for gay, bi, trans, and queer people, reported a security vulnerability that allowed anyone to hijack and take control of any user’s account using only their email address. Grindr’s password reset page was leaking password reset tokens to the browser, which meant anyone could trigger the password reset who had knowledge of a user’s registered email address, and collect the password reset token from the browser if they knew where to look. Thus with that crafted link, the malicious user can reset the account owner’s password and gain access to their account and the personal data stored within, including account photos, messages, sexual orientation and HIV status and last test date. Grindr addressed the issue and soon fixed it.