Data breach of the dating app Tea exposed thousands of user IDs and sensitive chats | Cyber Intelligence Briefing: 1 August 2025

Top news stories this week

1. Spilled Tea. Data breach of the dating app Tea exposed thousands of user IDs and sensitive chats.
2. Juice extraction. French telecom giant discloses cyberattack.
3. Not breached. BreachForums reportedly returns and denies law enforcement takedown.
4. Guards up. National Guard to support the City of Saint Paul after cyberattack.
5. Hull breach. Naval Group investigates cyber incident amid 1Tb data recycling claims
6. Equipment in limbo. The disability equipment provider NRS Healthcare faces a collapse.

1. Data breach of the dating app Tea exposed thousands of user IDs and sensitive chats 

A dating safety and men vetting app for women Tea experienced a major data breach as hackers obtained access to over 59GB of data. The data set included user's sensitive chats and thousands of personal documents, which started their online harassment, with data being shared online to expose the women that used the app. Affected users have filed two class action lawsuits against Tea for negligence and breach of implied contract. 

So what?

When designing and developing applications and systems organisations should ensure that they incorporate the principles of security-by-design and privacy-by-design, especially when these systems are meant to store sensitive user data which could endanger their health or life if exposed.

[Researcher: Milda Petraityte]

2. French telecoms giant discloses cyberattack

Orange, a French telecommunications company and one of the world’s largest telecom operators, disclosed last week that a system on its network had been breached. Some services were affected, but were expected to be fully restored within days, with ongoing investigations as to the impact.

So what?

Companies with a customer base numbering in the hundred of millions across corporate and individual accounts must properly assess the risk of data exfiltration and appropriately mitigate this as privacy regulations across the globe tighten and resulting potential fines increase in size and scope.

[Researcher: Lester Lim]

3. BreachForums returns on original dark web domain and denies it was compromised.

The notorious cybercriminal forum BreachForums has reportedly returned on its original dark web domain. The site was restored with its original infrastructure, databases, and forum posts. The platforms administrator claimed in a post that the site was taken down to fix a vulnerability and not due to law enforcement efforts.

So what?

Dark web forums and marketplaces continue to resurface due to their high demand. Organisations should proactively track their presence on the dark web via dark web monitoring.

[Researcher: Jon Seland]

4. National Guard to support the City of Saint Paul after cyberattack.

The state of Minnesota has deployed the National Guard to support restoration of critical services after a cyberattack struck the states capital, Saint Paul. The attack has caused widespread disruptions across the city, and its impact has exceeded St. Paul's incident response capacity. 

SO WHAT? 

Well-resourced cities and critical infrastructure are often lucrative targets for cyber criminals. It is important to have a fast and effective response plan in place to mitigate levels of disruption to critical services.

[Researcher: Tlhalefo Dikolomela ]

5. Naval Group investigates alleged data leak amid speculation of recycled information.

Naval Group, a majority French state-owned defense firm partially owned by Thales Group, is investigating a cyber incident after 1TB of allegedly stolen data appeared on a hacking forum. The company reported no signs of intrusion on their IT systems so far, and some speculate that the data comes from a 2022 data breach Thales Group suffered. 

So What?

Organisations should verify threat actor claims with thorough forensic investigations. 

[Researcher: Eleanor Ruler]

6. The disability equipment provider NRS Healthcare faces a collapse. 

NRS Healthcare, the disability equipment provider to NHS, is nearing compulsory liquidation after having suffered a cyberattack in March 2024 as the incident recovery costs impacted its balance sheet. The company began transferring its contracts to other providers as the NHS and the 40 councils across England warned that without this equipment patients cannot be safely discharged from hospital. 

SO WHAT? 

Organisations should carefully evaluate the business impacts and the risks of cyber attacks to their business and take appropriate measures to increase their cyber resilience.

[Researcher: Milda Petraityte]