A major security breach has left over 1.5 million private images and user details from five LGBTQ, sugar-dating, and BDSM apps publicly accessible, researchers have revealed. The affected apps—exclusively available on Apple’s iOS App Store—were developed by M.A.D. Mobile Apps Developers Limited.
The leaked data includes profile photos, public posts, verification images, pictures removed for rule violations, and even private images shared through direct messages, raising serious privacy concerns.
The breach impacted users of the following dating platforms:
BDSM People – a kink-focused dating app
BRISH – a dating app for queer men
Chica – a high-end app for sugar-dating
PINK – a dating app for queer women
TRANSLOVE – a platform catering to trans and queer individuals
This leak underscores the ongoing risks of data security in online dating spaces, particularly for marginalized communities.
Cybernews researchers, who first discovered the breach, reported that the leaked data also contained “secrets”—sensitive information like encryption keys and API keys. While usernames, emails, and text messages were not included in the leak, malicious agents could still use the available data to uncover user identities.
Also read: Using Online Dating Apps Safely—Look Before You Swipe!
A Breach of Trust: Safety, Privacy, and Accountability in LGBTQ and BDSM Dating Apps
These apps market themselves as safe spaces for LGBTQ+ individuals and BDSM practitioners, but the leak puts users at risk of extortion and being outed. According to the BBC, the 5 apps collectively have about 800,000 to 900,000 users. The “secret” keys embedded in the app code grants access to storage buckets containing millions of private images, including explicit photos shared in user chats and images removed by moderators.
The BBC also reported that in an email, M.A.D. Mobile conveyed that they were grateful to the researcher who uncovered the vulnerability of these apps. A spokesperson for M.A.D Mobile said that additional updates for these apps would be released on the App Store. However, the company did not respond to further questions about where the company’s HQ is based out of, or why it took them months to address the issue.
Also read: Content Moderation on Social Media from a Queer-Trans Perspective
The High Stakes of Data Security: Why Privacy Breaches Endanger LGBTQ+ Communities in India
This breach underscores the urgent need for stronger data privacy protections and greater accountability—especially for platforms that claim to offer safe spaces for marginalized communities in regions with limited legal protections.
Take India, for instance, where there are no clear anti-discrimination laws safeguarding LGBTQ+ individuals, nor is there proper legal recognition of queer identities.
For many young LGBTQ+ Indians, particularly those who are not out to their families or broader communities, dating apps provide a rare opportunity to explore their identities and find connection. But breaches like this one put them at severe risk—turning what should be a sanctuary into a potential threat. Being outed through a data leak can have devastating consequences, including family rejection, job loss, extortion, and even violence.
Moreover, India’s legal system has historically failed to recognize men as victims of sexual violence. This creates a dangerous gap for queer men facing harassment or blackmail through dating apps, making it even harder for them to seek justice.
India urgently needs enforceable anti-discrimination laws that not only recognize and protect queer identities but also safeguard against digital threats like these. At the very least, young LGBTQ+ people—especially those who are closeted—deserve to use dating platforms without fear of exposure, harassment, or violence. Ensuring their safety online isn’t just about better regulations—it’s about recognizing their right to exist freely and without fear.
