Tea Hack

This article is a stub. You can help by expanding it.

In June 2025, a mobile app called Tea was hacked and at least 55GB of its entire database was leaked online (possibly more). However, calling it a hack is very generous: all the info about its users was stored on an UNSECURED server, so it would be like calling "downloading your ex's photos off Instagram" as a "hack".

What's The "Tea"?

Besides the thing that HEROIC AMERICANS dumped into the river back in 1776, Tea is/was an app that allowed women to share "red flags" and "icks" about the men they're dating so that other women don't suffer from dating someone who is an anime fan or take selfies. However, in order to sign up, users had to literally send the app a picture of their government-issued ID to prove they weren't a dude. A picture of their government-issued ID, complete with their full government name, address and ID number... being sent to a completely unsecure server.

The main appeal of the Tea app is that women could anonymously "spill the tea" on guys they dated to keep other women safe. Of course you and I know that this was a dumb idea and doomed from the start, but the women who got suckered into it didn't, because Daddy never taught them about online security best practices inbetween all the times they kept calling them "my little princess". They also weren't taught that just because someone was anonymous it doesn't mean they're telling the truth (otherwise all the shitposting on /b/ was actually true and moot was lying to us), and many of them ruined their own lies by treating some random woman's insane ramblings about their man as the God-given truth. In a seven year marriage and some rando on Tea said "oh yeah I'm dating him" with NO WAY to verify it? OBVOUSLY they're telling the truth!

With this data leak, however, it shows that anonymity is not guarantied. In fact, the ultimate karmic irony here is that all the info these women shared about themselves in order to post about men behind those mens back are now being disseminated behind those women's backs.

The First Leak

You can trust us to not delete this info!

The first leak came because the app was using Google's Firebase service to store its data, and some egghead thought it was a good idea to leave that data UNPROTECTED. Like, there was literally a switch that keeps that data open and unsecured which Google regularly warns its users not to use outside of testing purposes... but the Tea devs used it anyways.

The icing on the cake is that Tea says that the selfie/ID check was temporary and that that data would be deleted immediately after. Oh, and they also said "well, it's older data from 2024 or earlier", as if MF are regularly changing their drivers liceneses and home addresses every year or something.

The "hack" itself wasn't much of anything... in fact it could be best described as "vibe coding" (ie using AI prompts to explain what you want and AI fills in the details for you).

Anyways, this leak just happened, so the long-term ramifications of it have yet to be determined. Tea acknowledged that it did happen, but claimed that is wasn't that big of a deal. Too bad for them that consumer protection laws in California alone means the Tea devs are going to be in some serious shit very shortly. But it's worth noting that if this is the worst it gets, then maybe, just maybe they'll weather this storm. Because even if their backend was exposed for this long, hopefully this leak would be the only leak that occurs.