Security researchers from Cybernews discovered an unsecured MongoDB instance belonging to Headero, a dating and hookup app. The database contained over 350,000 user records, including names, email addresses, social login IDs, JWT tokens, profile pictures, device tokens, sexual preferences, STD status, and exact GPS locations. Although the database was immediately locked down by ThotExperiment, it is unclear how long it remained open or if any threat actors accessed it. No evidence of abuse has been found so far. Users are advised to be vigilant against phishing attacks and to change passwords if they are used across multiple services.