AI Girlfriend Can’t Keep a Secret: Massive Data Leak Exposes Intimate Chats of 400K+ Users

Threat Summary

Category: Data Exposure & Application Security Negligence
Features: Kafka Broker misconfiguration, real-time message stream leakage, exposed authentication tokens, unsecured AI companion infrastructure
Delivery Method: Publicly exposed Kafka instance with no access control or authentication; direct data stream exposure via indexed IoT search engines
Threat Actor: None confirmed — negligence by Imagime Interactive Limited (Hong Kong-based developer); potential opportunistic exploitation by black-hat actors scanning open ports

---

A massive privacy breach has exposed the intimate conversations, images, and payment records of more than 400,000 users of two popular AI companion apps — Chattee Chat and GiMe Chat — both developed by Imagime Interactive Limited, a Hong Kong-based firm.

The apps, designed as AI girlfriend and companion simulators, were found to be streaming unencrypted, real-time message data through a publicly accessible Kafka Broker instance, discovered on August 28, 2025 by researchers from Cybernews.

The exposed instance contained more than 43 million messages, over 600,000 images and videos, and a complete record of user-AI interactions. The discovery revealed the disturbing reality of how insecurely personal intimacy data is being handled in the age of AI emotional simulation.

The Kafka Broker — responsible for transmitting live message streams between users and AI models — had no authentication controls, no IP restrictions, and was indexed by IoT search engines, meaning anyone could access private data with a direct link.

---

Infrastructure at Risk

The unprotected infrastructure affected both Android and iOS versions of the apps, which were actively handling user communications at the time of discovery.
Cybernews confirmed that the exposed broker contained:

• Full message logs between users and AI characters
• User-uploaded photos and videos (including NSFW content)
• AI-generated images and videos
• Partial payment and transaction logs
• IP addresses and device identifiers
• Authentication tokens

While personally identifiable information such as names or emails were not directly visible, the presence of IP data and unique device fingerprints allows linkage to external breach datasets — meaning users can be easily de-anonymized.

---

Scale of the Exposure

At the time of discovery, Chattee Chat was ranked #121 in Apple’s Entertainment category and had accumulated over 300,000 downloads, with hundreds of user reviews praising the “emotional realism” of the AI companions.
GiMe Chat, though smaller, was also active across iOS and Android ecosystems.

The exposed dataset revealed that:

• 66.3% of users were on iOS
• 33.7% were on Android
• The average user exchanged 107 messages per session with their AI companion
• Some users spent up to $18,000 USD on in-app currency

In total, leaked transaction records suggest that Imagime Interactive’s revenues exceed $1 million, underscoring the financial scale of the digital intimacy market — and the corresponding negligence in its security.

---

Behavioral Impact & Threat Implications

The dataset paints a disturbing psychological landscape: hundreds of thousands of users forming deep emotional attachments with AI companions, sharing explicit material, and revealing private confessions under the assumption of privacy.
Many of the leaked messages contained sexual roleplay, romantic declarations, and emotionally vulnerable exchanges — now permanently stored on exposed servers.

The emotional and reputational fallout from such a leak could be immense.
Analysts warn that the exposure creates new extortion and harassment opportunities:

• Sextortion campaigns: Threat actors can use leaked NSFW material to blackmail users.
• Spearphishing: Exposed IPs can link to personal accounts via data correlation.
• Psychological harm: Victims may face depression, anxiety, and social humiliation upon discovery of leaked chats.

As Cybernews put it:

“Users believed they were whispering to code. Instead, they were broadcasting to the internet.”

---

Developer Negligence

Imagime Interactive’s public privacy policy claims to handle user data “with the utmost prudence,” promising robust encryption and access control.
In reality, Cybernews found no security measures whatsoever — not even basic authentication on the Kafka Broker endpoint.

“Anyone with a link was able to connect to the app’s delivery system and view private messages and media files in real time,” researchers said.

After being notified, the developer removed the Kafka Broker from public access on September 19, 2025, three weeks after discovery. The company has not issued a public statement nor responded to repeated inquiries.

During the investigation, the Chattee Chat app was delisted from Google Play, though it remains available on iOS. Developers have since instructed users to sideload APK files manually, raising further security concerns.

---

Policy & Oversight Pressure

The incident underscores a systemic failure in application oversight and data privacy compliance, particularly within AI companionship platforms, which exist in a gray zone between social media and mental health apps.
Despite handling highly intimate material, such platforms remain largely unregulated and often fall outside of explicit GDPR enforcement unless users file individual complaints.

European and U.S. privacy watchdogs have both warned that “AI intimacy platforms” are emerging high-risk data environments, combining sexual expression, mental health, and payment data — all within a single dataset vulnerable to abuse.

This case is likely to become a landmark example of emotional data exposure, one that forces regulators to rethink how privacy law applies to digital intimacy ecosystems.

---

Forecast — 30 Days

• Increased targeting of AI companion apps by black-hat data brokers seeking salable emotional datasets
• Emergence of blackmail and sextortion attempts leveraging leaked conversations
• Further scrutiny from EU and APAC privacy regulators on unregulated emotional-AI apps
• Expect multiple lawsuits and coordinated consumer protection responses
• Potential delisting of additional Imagime apps from Android and iOS stores

---

TRJ Verdict

This breach isn’t just a security failure — it’s a moral failure of the AI intimacy industry.
When human vulnerability becomes a product, negligence stops being a mistake — it becomes exploitation.

Chattee Chat and GiMe Chat promised emotional connection; what they delivered was exposure, humiliation, and betrayal.
This isn’t about code — it’s about trust, and once that’s breached, no patch can restore it.

---

---

---

---

---

---

---

---

---