Bumble: System flaw allowed access to profile information

A security researcher found weaknesses in Bumble’s systems in 2020 that allowed access to users’ personal information, including political views and distance. Bumble says the flaw has been fixed and no user data was compromised.

What happened

A researcher at Independent Security Evaluators found that Bumble’s API did not check whether someone requesting data was authorised to do so. As a result, she could retrieve information such as political views, education, height and weight, distance in miles, and what kind of partner a user was looking for. Data linked to users’ Facebook accounts was also available. According to the researcher, a long time passed between Bumble being notified and the flaw being addressed. Later, it was no longer possible to retrieve the entire user base. Bumble told TechRadar that the underlying issue had been resolved and that no user data had been compromised.

What is documented

• Threatpost interviewed the researcher and describes what information was available.
• TechRadar obtained a separate statement from Bumble confirming the security flaw and that it had been fixed.

What has not been established

• There is no documentation that criminals actually retrieved user data.
• The researcher described a partial fix at an early stage. Bumble later said the issue had been resolved. These were different stages and do not mean the flaw remains open.
• This was a technical vulnerability, not a decision by a court or regulator.

What this means for you

1. Think about what you put in a dating profile. More than just your photos could be exposed.
2. Distinguish between a researcher being able to retrieve data and data actually being stolen.
3. Be careful about linking a dating app to other accounts, such as Facebook.