9 niche dating apps and hundreds of thousands of users exposed by leaky bucket

Updated October 13, 2022

Published June 20, 2020

We may earn a commission via links on our site.

Our editorial policy and independence is vitally important to us. It has been crafted drawing upon more than 15 years of publishing experience – we wouldn’t jeopardise this reputation for a free product or travel of any kind.

At SEXTECHGUIDE, transparency, honesty, and integrity are the core of our values. We are committed to providing high-quality, unbiased content to our readers. Below are our detailed guidelines on how we maintain our editorial independence and ethical standards. We do not accept sponsored content or link insertion requests.

A clutch of dating apps, mostly catering to specific niche audiences, have been the subject of a data breach involving nearly one terabyte of private information, left on an unsecured server.

The nine dating sites affected, which appear to be from a single developer are: 3somes, CougarD, Gay Daddy Bear, Xpal, BBW Dating, Casualx, SugarD, GHunt and Herpes Dating.

Although it hasn’t been confirmed that all nine are indeed sister-sites, the name and address of the developers often tally up, and the design language is similar enough.

Explore topics mentioned in this article

dataDating AppsUser Data

The culprit appears to be a familiar one to techie types – a ‘misconfigured bucket’ in Amazon Web Services (AWS). In other words, a data store that should have been robustly secured, but was left without said security.

This has been the cause of a raft of data breaches over the years, because securing them does not happen automatically and many developers either forget, or assume protection is enabled by default. Not only was user data exposed, the actual hosting infrastructure for each of the apps was also accessible.

According to VPNMentor, which found the bucket, there were 20,439,463 files exposed, with the number of users affected ‘estimated to be 100,000s’, all over the world.

Some of the content included photos, many of them explicit, as well as ‘private’ chats between users, financial transactions and audio recordings.

After VPNMentor contacted one of the site developers, it found that the data for all the sites was secured, further fueling speculation that this is a single developer.

If you use any of the above apps, the best thing to do is contact the developer for advice. Usually, we’d recommend changing your password, but as no theft has been confirmed (the data was exposed, it’s impossible to know if it was taken yet), no breach has affected the front-end of the sites, and the sites are now secure, it hardly seems worth it.

The question now will be whether any of the data has made it into the public domain before it was discovered. Hopefully, VPNmentor’s belief that it found the bucket in time proves to be true.

SEXTECHGUIDE has contacted the (presumed) developer for comment. We’ll update this story if there is a response.

Article by

Chris M

Chris M has worked in technology journalism for over a decade, and brings his nerdy expertise to looking at what goes on under the hood of sex tech.With over a decade of expertise in his field, Chris brings a nerdy perspective to his exploration of the fascinating world behind the scenes. His articles have graced the pages of renowned publications such as Engadget, TechRadar, AskMen, and The Register.

Get in touch