Chinese database exposes 42.5 million records compiled from multiple dating apps

Most of the data was about American users.

Tens of millions of records about users of different dating apps have been discovered in a single database that doesn’t include any password protection, according to new research findings.

The records discovered by researcher Jeremiah Fowler mostly were about American users, based on accessible IP addresses and geolocation information. Other data included age, location and account names — a roadmap Fowler followed to identify users across multiple other platforms and dating apps to verify they were real.

A sampling of 10,000 users revealed that 8,063 were from the U.S., 356 were from the U.K., 219 from Canada and 151 from Australia and other random English-speaking countries, he said in an email to CyberScoop.

About 42.5 million records were exposed, Fowler said. Dating logs made up 38.3 million records, while 3.87 million consisted of “geonames,” Fowler said. He did not reveal the location of the database, which uses the Elastic format.

While it’s not clear who controls the leaky database, Fowler accessed the site’s Whois domain registration to find that a subway line in Lanzhou, China was given as the owner’s address. Dialing the phone number only reached a line that had been powered off, he said.

Apps mentioned in the database seemed meant to appeal to as many people as possible, the researcher wrote in a blog post Tuesday, with names ranging from “Christiansfinder” and “Cougardating” to “Mingler” and “Fwbs,” shorthand for “friends with benefits.” Each had a dedicated website or app under those names, Fowler said.

The database also contained Chinese-language commands, which translated to “The model update completion event has been triggered, syncing to the user,” according to Fowler. The only way to contact the developer would be to install the applications.

“I am not saying or implying that these applications or the developers behind them have any nefarious intent or functions, but any developer that goes to such great lengths to hide their identity or contact details raises my suspicions,” Fowler wrote. “Call me old fashioned, but I remain skeptical of apps that are registered from a metro station in China or anywhere else.”

The database, which was still online at press time, did not include financial information, though it did provide a path for outsiders to view personal details about an app user, Fowler wrote.

Fowler’s findings are yet another example of sloppy database-security practices potentially affecting unsuspecting victims. A security researcher in February told CyberScoop about an unrelated database containing information from roughly 14 million Instagram accounts, apparently collected by a third party that was scraping data for analysis later. Motivation in that case could have included targeted marketing or combining leaked usernames with stolen passwords to breach social media identities.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure