Coffee Meets Bagel: Names and emails of about 6 million users stolen

Coffee Meets Bagel told users in February 2019 that an unauthorised party had obtained names and email addresses. About 6 million users were affected.

What happened

On 14 February 2019, Coffee Meets Bagel emailed users to say that an unauthorised party had gained access to a partial list of user details. The company said it learned of this on 11 February. The data surfaced as part of a larger collection of about 617 million accounts from several websites offered for sale on the dark web. According to the company, the affected information was users' names and email addresses from before May 2018. It said it does not store financial information or passwords. A spokesperson told TechCrunch that about 6 million users were affected. The company said it had hired forensic security experts, was auditing vendors and was working with law enforcement. Passwords were not reset.

What is documented

• Coffee Meets Bagel (email to users, quoted by TechCrunch and The Verge): unauthorised access; names and email addresses before May 2018.
• TechCrunch: a company spokesperson confirmed about 6 million affected users.
• The Verge: the data was part of a larger set of more than 617 million account details offered on the dark web.

What has not been established

• How the attackers got in.
• Earlier reports cited by TechCrunch said the data could include age, registration data and gender; the company's email said only names and email addresses were affected.

What this means for you

1. Be wary of emails that appear to come from your dating app after a leak; log in through the app instead of clicking links.
2. Check whether your email address appears in known leaks, using a breach-notification service.
3. Use a unique password, even if the service says passwords were not affected.