Match Group Data Breach

On January 27, 2026, ShinyHunters claimed responsibility on their leak site for stealing over 10 million records. The data came primarily from the mobile marketing platform AppsFlyer and included advertising IDs, profile/usage data, subscription details, IP addresses, and internal corporate documents. Access was obtained via vishing (voice phishing) targeting Okta SSO credentials. Match Group confirmed investigating a security incident but stated that core user passwords, payment data, and private messages were not compromised.

Match Group operates some of the world's largest dating platforms, holding highly sensitive personal and relationship-related data for hundreds of millions of users worldwide.

Attackers used social engineering (vishing) to compromise employee Okta SSO credentials, then pivoted to internal dashboards and third-party marketing platforms like AppsFlyer.

Vulnerabilities exploited

• Human vulnerability to vishing

ShinyHunters is a prolific cybercriminal extortion group known for vishing attacks, SSO compromise, and targeting large consumer/tech companies for financial gain.

Aliases

• SH
• Scattered LAPSUS$ Hunters

Attribution sources

• ShinyHunters leak site
• BleepingComputer
• The Register
• UpGuard
• Match Group statements

Countries affected

• Global

Data types

• PII
• Mobile Advertising IDs (MAIDs)
• IP addresses
• Subscription transaction data
• User profile / usage data
• Internal corporate documents

Reputational damage; potential class-action lawsuits; costs for user notifications and security enhancements.

Public reaction

Significant concern among users regarding privacy, potential stalking, and blackmail risks.

Ongoing investigations and class-action lawsuits filed.

Civil lawsuits

• Class-action lawsuits related to data privacy failures

Security improvements

• Enhanced employee training against vishing
• Strengthened Okta/SSO monitoring and controls

Significance

High-profile breach of major dating platforms demonstrating the rising threat of vishing and third-party data platform compromises.

Legacy

Increased awareness of social engineering risks in consumer tech companies handling sensitive personal data.

Publishing organisations

• BleepingComputer
• The Register
• UpGuard
• Cybernews

Match Group contained the incident, notified affected users where required, and stated that core sensitive user data (passwords, messages, payment info) was not compromised.

Official documents

• Match Group security incident statement

References

1. [1]BleepingComputer reports
2. [2]The Register coverage
3. [3]UpGuard analysis
4. [4]Match Group official statements