Overview

• The unauthorized access compromised about 72,000 images from pre-February 2024 accounts, including 13,000 verification selfies and 59,000 public photos.
• Users who signed up after February 2024 were unaffected, and no email addresses or phone numbers were accessed.
• Hackers exploited a legacy identifier link to extract archived data that had been retained for cyberbullying prevention compliance.
• A coordinated hack-and-leak operation on 4chan propelled the stolen images into underground forums and onto X.
• Tea has launched a comprehensive investigation, enlisted external cybersecurity specialists and strengthened its security infrastructure.