Match Group breach exposes data from Hinge, Tinder, OkCupid, and MatchMatch Group breach exposes data from Hinge, Tinder, OkCupid, and Match

In late January 2026, Match Group, the parent company of Tinder, Hinge, Match.com, OkCupid and Meetic, confirmed a security incident after the extortion group ShinyHunters listed it on its data leak site. The hackers claimed to have taken more than 10 million records tied to Hinge, Match and OkCupid, along with hundreds of internal documents, and they published about 1.7 gigabytes of compressed files when the company did not meet their demands.

The attack relied on social engineering rather than a software exploit. According to BleepingComputer, the intruders used voice phishing, calling an employee and directing them to a lookalike domain designed to harvest credentials for Match Group's Okta single sign-on system. Once inside the employee's SSO account, the attackers could reach connected services, including the AppsFlyer marketing analytics platform and cloud storage, where user-level app data and company files were kept.

Match Group said it acted quickly to terminate the unauthorized access and brought in outside experts. The company confirmed that some personal information and tracking data were exposed but said it had found no evidence that login credentials, financial information or users' private chats were taken. It said it was notifying affected users where appropriate. Although Tinder appeared in some headlines, the hackers' claims centered on Hinge, Match and OkCupid data.

The breach was part of a broader ShinyHunters campaign in early 2026 that targeted SSO accounts at multiple companies through vishing. Other reported victims in the same wave included Panera Bread and fellow dating company Bumble. The group had previously been linked to a string of 2025 attacks that abused access to corporate Salesforce environments, and it has become one of the most prolific data-extortion operations targeting consumer brands.

For dating app users, even data that excludes messages can be sensitive, since membership in a dating service can itself reveal relationship status or sexual orientation and expose people to harassment or blackmail. For companies, the incident reinforced that single sign-on concentrates risk: one phished login can unlock many downstream systems. Security experts pointed to phishing-resistant authentication, such as FIDO2 security keys and passkeys, as the most effective defense against this kind of attack.