TRJ CYBERSECURITY INTEL REPORT
Category: Mobile App Data Breach & Exploitation
Features: Legacy storage failure, exposed identity documents, user doxxing, mass reposting
Delivery Method: Publicly accessible Firebase bucket, authentication failure
Threat Actor: Unknown (under investigation), data actively reposted by misogynist communities and cybercrime groups
A data breach involving the controversial relationship-vetting platform known as Tea has exploded into a full-blown security and privacy catastrophe. Initially positioned as an app for women to crowdsource background checks on men, Tea is now at the center of a mass identity theft event — with over 72,000 private user images leaked, including thousands of U.S. driver’s licenses and personally identifying selfies.
By the end of the weekend, screenshots of these stolen documents had made their way into cybercriminal markets, public forums, and antagonistic online spaces targeting women, turning what began as a legacy system oversight into a nationwide digital manhunt.
WHAT WAS BREACHED?
According to the company’s own admission, the breach affected a “legacy data storage system” that housed archives from users who joined before February 2024. The figures confirmed so far:
- 13,000 facial verification images with ID photos (driver’s licenses, passports)
- 59,000 user-uploaded images from app posts, direct messages, and comments
- 72,000+ total compromised assets, according to internal logs
- Reported leak size: 55 GB, now circulating through cybercrime channels
The leak was first confirmed by investigative reporting from 404 Media, then amplified through digital forensics reviews shared with Recorded Future News. Tea’s development team verified the breach late Friday.
But the damage was already done.
HOW IT HAPPENED:
Security analysts and independent researchers uncovered that Tea had stored sensitive user submissions — including driver’s licenses — inside a publicly accessible Firebase storage bucket. Firebase, a backend-as-a-service product owned by Google, supports mobile and web applications with real-time data syncing and cloud hosting. But when misconfigured, it becomes an open vault.
In this case, no authentication wall was in place, allowing anyone with the URL structure to browse, scrape, or automate the download of entire image folders. Posts on 4chan, X, and private Telegram groups circulated the links before Tea acknowledged the breach.
ESCALATION TIMELINE:
- Friday, July 26: Tea acknowledges breach. Data confirmed to be from pre-2024 accounts. Public Firebase bucket identified.
- Saturday, July 27: 4chan and other hostile online communities begin doxxing users, posting screenshots of IDs with locations.
- Sunday, July 28: Collated user IDs traced back to U.S. military bases, universities, and professional institutions.
- Monday, July 29: Cybercriminal forums advertise full dumps: “55GB of women’s selfies, licenses, dox — verified Tea dump.”
Some attackers used facial recognition tools to cross-reference users with LinkedIn profiles or personal social media, escalating the incident into a coordinated campaign of exposure and harassment.
TRUST SHATTERED: THE FALSE PROMISE OF “SAFE” VERIFICATION
Tea’s onboarding page promised users their identification documents would be deleted after verification. But the company has now admitted that all documents were archived — allegedly for “law enforcement compliance related to cyberbullying prevention.”
No documentation proving such legal mandates has been shared publicly.
No FOIA disclosures or legal citations have been provided.
No explanation has been given as to why a Firebase bucket with unencrypted, unprotected ID images was ever allowed to exist.
Tea’s vague PR responses failed to address:
- Whether a ransom was issued
- If the breach was reported to the FTC or relevant state authorities
- What data security partners were brought in
- Whether third-party vendors (e.g., Google/Firebase) are also under audit
A TOOL OF EMPOWERMENT, TURNED AGAINST ITS USERS
Originally billed as a digital empowerment app for women, Tea marketed itself as a way to vet men for red flags — criminal records, infidelity, abusive behavior, and more. But critics argued from the beginning that the app operated in legal gray zones, collecting and posting unverified accusations while encouraging anonymous user input.
Now, the same tool that promised safety has exposed thousands of women to retaliation, identity theft, and potential real-world harm. Even more disturbing, many of the users caught in the breach may have uploaded their information under emotionally vulnerable conditions — including domestic violence survivors, young adults exploring dating after trauma, and whistleblowers seeking private spaces.
THE DARK WEB NOW OWNS THIS
Cybercriminal posts examined by TRJ confirm that full image dumps are now being:
- Repackaged into facial recognition training datasets
- Parsed for military, government, and influencer targets
- Used to create deepfake content and synthetic ID templates
- Traded for cryptocurrency in invite-only forums
Several private chat groups have begun compiling “Tea Target Lists” with user IDs, locations, and social handles attached — turning this into a slow-rolling digital assault with real-world risk.
WHAT COMES NEXT:
Tea has engaged unnamed cybersecurity experts and claimed its systems are now being “hardened.” But as of now, the following remain unknown:
- Whether breach victims will be formally notified
- If the company will face civil liability or state enforcement
- Whether the FTC or GDPR (for EU users) will launch an investigation
- If user images are still hosted or cached on backup servers
The core issue remains: this wasn’t just a technical oversight. It was a systemic failure in data responsibility.
TRJ VERDICT:
The real story isn’t just that private photos were stolen. It’s that an app designed to expose red flags became one itself. In a time when trust is sold as a feature, the greatest danger is not what users willingly reveal — but what platforms quietly archive.
🔥 NOW AVAILABLE! 🔥
📖 INK & FIRE: BOOK 1 📖
A bold and unapologetic collection of poetry that ignites the soul. Ink & Fire dives deep into raw emotions, truth, and the human experience—unfiltered and untamed.
🔥 Kindle Edition 👉 https://a.co/d/9EoGKzh
🔥 Paperback 👉 https://a.co/d/9EoGKzh
🔥 Hardcover Edition 👉 https://a.co/d/0ITmDIB
🔥 NOW AVAILABLE! 🔥
📖 INK & FIRE: BOOK 2 📖
A bold and unapologetic collection of poetry that ignites the soul. Ink & Fire dives deep into raw emotions, truth, and the human experience—unfiltered and untamed just like the first one.
🔥 Kindle Edition 👉 https://a.co/d/1xlx7J2
🔥 Paperback 👉 https://a.co/d/a7vFHN6
🔥 Hardcover Edition 👉 https://a.co/d/efhu1ON
Get your copy today and experience poetry like never before. #InkAndFire #PoetryUnleashed #FuelTheFire
🚨 NOW AVAILABLE! 🚨
📖 THE INEVITABLE: THE DAWN OF A NEW ERA 📖
A powerful, eye-opening read that challenges the status quo and explores the future unfolding before us. Dive into a journey of truth, change, and the forces shaping our world.
🔥 Kindle Edition 👉 https://a.co/d/0FzX6MH
🔥 Paperback 👉 https://a.co/d/2IsxLof
🔥 Hardcover Edition 👉 https://a.co/d/bz01raP
Get your copy today and be part of the new era. #TheInevitable #TruthUnveiled #NewEra
🚀 NOW AVAILABLE! 🚀
📖 THE FORGOTTEN OUTPOST 📖
The Cold War Moon Base They Swore Never Existed
What if the moon landing was just the cover story?
Dive into the boldest investigation The Realist Juggernaut has ever published—featuring declassified files, ghost missions, whistleblower testimony, and black-budget secrets buried in lunar dust.
🔥 Kindle Edition 👉 https://a.co/d/2Mu03Iu
🛸 Paperback Coming Soon
Discover the base they never wanted you to find. TheForgottenOutpost #RealistJuggernaut #MoonBaseTruth #ColdWarSecrets #Declassified
Support truth, health, and preparedness by shopping the Alex Jones Store through our link. Every purchase helps sustain independent voices and earns us a 10% share to fuel our mission. Shop now and make a difference!
https://thealexjonesstore.com?sca_ref=7730615.EU54Mw6oyLATer7a
Sponsored • TRJ Ads
Inquiries: contact@therealistjuggernaut.com
How is it that so many things like this that were designed for something helpful wind up being such a big mess and the opposite of what it was intended to be? “A systemic failure in data responsibility” is right John. We will probably not know the full extent of the negative consequences of this for quite some time.