Security News > 2020 > June > 845GB of racy dating app records exposed to entire internet via leaky AWS buckets

Hundreds of thousands of sensitive dating app profiles - including images of "a graphic, sexual nature" - were exposed online for anyone stumbling across them to download. Word of the uncontrolled emission burst forth from vpnMentor this week, which claims it found a misconfigured AWS S3 bucket containing 845GB of private dating app records.

"Aside from exposing potentially millions of users of the apps to danger, the breach also exposed the various apps' entire AWS infrastructure through unsecured admin credentials and passwords," vpnMentor's researchers wrote.

The haul is estimated to contain hundreds of thousands of users' data, all exposed to the public internet without any authentication.

The storage silo was used by nine rather niche dating apps, including SugarD, which connects sugar daddies with sugar babies, whom they financially support with gifts and cash.

Just who built the apps and made the fateful decision to misconfigure the buckets is not known, though vpnMentor suspects the nine services share a common developer.

News URL

https://go.theregister.com/feed/www.theregister.com/2020/06/16/dating_apps_aws_s3_leak/