Jack'd: Private nude photos left exposed for a year

A security flaw made photos users had marked as private accessible to anyone. The company knew about the flaw but fixed it only a year later, and paid $240,000 in a settlement.

What happened

The dating app Jack'd, aimed at gay and bisexual men, stored photos that users had marked as private on a server that required no login. Anyone with the right link could view them. According to the New York Attorney General, the company behind the app, Online Buddies, knew of the vulnerability by February 2018 at the latest but fixed it only after repeated press inquiries a year later. Besides the photos, data such as location, device ID and last login time was exposed. The Attorney General estimated that around 1,900 active users in New York may have had nude photos among their private photos. In June 2019 the company settled with the State of New York.

What is documented

• New York Attorney General: the company knew of the vulnerability by February 2018 and fixed it about a year later.
• New York Attorney General: around 1,900 New York users may have had nude photos among the exposed private photos.
• Settlement on 28 June 2019: $240,000 to New York State and a requirement to run a comprehensive security programme.
• The BBC reported the settlement the same day.

What has not been established

• Whether unauthorised people actually downloaded photos, and whether individual users were harmed.
• How many users outside New York were affected.

What this means for you

1. Assume a photo marked "private" in an app may be seen by others. Share only what you can live with.
2. Delete old private photos you no longer need stored.
3. Check a service's track record before uploading sensitive content.