okcupid

The European Commission has confirmed a data breach after its Europa.eu web platform was hacked in a cyberattack claimed by the ShinyHunters extortion gang. BleepingComputer first reported on Friday that this breach affects at least one of the Commission's AWS (Amazon Web Services) accounts. The Commission says the attack didn't disrupt any Europa websites and that its staff took measures to contain the incident and prevent further data theft. "Early findings of our ongoing investigation suggest that data have been taken from those websites. The Commission is duly notifying the Union entities who might have been affected by the incident. The Commission's services are still investigating the full impact of the incident," the European Union's main executive body said in a Friday press release published after BleepingComputer reached out for more details on the cyberattack. "The Commission's internal systems were not affected by the cyber-attack. The Commission will continue to monitor the situation and take all necessary measures to ensure the security of its internal systems and data. It will analyse the incident and use the results to further enhance its cybersecurity capabilities." While the Commission didn't share further information regarding the attack, the threat actor who claimed responsibility for the breach told BleepingComputer last week that they had stolen over 350 GB of data before their access was blocked, including multiple databases. Although they didn't share how they breached the Commission's Amazon AWS accounts, they provided screenshots proving they had access to some European Commission employees' data. Data extortion group ShinyHunters has also added an European Commission entry to its dark web leak site, claiming that the theft of "data dumps of mail servers, datavases, confidential documents, contracts, and much more sensitive material," and released an archive of over 90GB of files allegedly stolen from the Commission's compromised cloud environment. In recent months, ShinyHunters has claimed breaches at Infinite Campus, CarGurus, Canada Goose, Panera Bread, Betterment, SoundCloud, PornHub, and online dating giant Match Group (which owns multiple popular dating services, including Tinder, Hinge, Meetic, Match.com, and OkCupid). Some of these victims were breached in a large-scale voice phishing (vishing) campaign that targeted single sign-on (SSO) accounts at Okta, Microsoft, and Google across more than 100 high-profile organizations. The Commission was hit by another data breach in February after discovering that the mobile device management platform it uses to manage staff's devices had been hacked. These security breaches were disclosed after the Commission's proposed new cybersecurity legislation to strengthen member states' defenses against state-backed actors and cybercrime groups targeting their critical infrastructure. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Major technology and retail companies announced on Monday that they have signed an accord that aims to combat online scams and fraud. The list of companies that have pledged their support for the initiative includes Google, Meta, Microsoft, Adobe, Amazon, OpenAI, LinkedIn, Pinterest, Match Group (owner of Tinder and OKCupid), Levi Strauss, and Target. The industry accord outlines the measures its signatories are prepared to take regarding prevention, cooperation, resilience, and public awareness. Prevention includes deploying technical and in-product solutions to identify and address fraud and scam attempts, implementing and enforcing anti-scam usage policies, implementing verification mechanisms, and strengthening authorization and authentication for payment services typically abused by fraudsters. In terms of cooperation and collective learning, the organizations that signed the accord have committed to sharing information on scam trends, detection, and prevention, and providing law enforcement an efficient way to report abuse of their services. In an effort to improve resilience to scams and online fraud, the corporate giants have pledged to adopt cybersecurity best practices, respond quickly to adversarial shifts and incidents, and boost collaboration to develop defensive tools, all while protecting user privacy and freedom of expression. The signatories have also committed to engaging in joint efforts to educate users. and providing clear and accessible channels for reporting scams. The companies also called on governments to do their part by formally declaring scam prevention a national priority and allocating a budget for anti-scam efforts. Governments have also been urged to modernize data collection and analysis for combating financial crimes, boost information sharing, and review laws that may hinder anti-scam efforts. Related: FBI: $20 Million Losses Caused by 700 ATM Jackpotting Attacks in 2025 Related: Account Takeover Fraud Caused $262 Million in Losses in 2025: FBI Related: Analysis of 6 Billion Passwords Shows Stagnant User Behavior

The ShinyHunters extortion gang has claimed responsibility for breaching Dutch telecommunications provider Odido and stealing millions of user records from its compromised systems. Odido is one of the largest telecommunications companies in the Netherlands and offers mobile, broadband, and television services to millions of customers nationwide. The company disclosed the breach on February 12, revealing that attackers downloaded the personal data of many of its users after gaining access to its customer contact system on February 7. However, Odido added that no Mijn Odido passwords, call details, location, data, billing data, or scans of identity documents were exposed during the incident. According to the telecom firm, the exposed information varies per customer and may include a combination of full name, address and city of residence, mobile number, customer number, email address, IBAN (bank account number), date of birth, and some identification details (passport or driver's license number and validity). It also told local media at the time that the data breach affected 6.2 million customers and that the threat actors reached out to say they had stolen millions of user records. After discovering the incident, Odido has reported the breach to the Dutch Data Protection Authority, blocked the attackers' access to its systems, and hired external cybersecurity experts to assist with incident response and mitigation. An Odido spokesperson didn't provide further information on the incident when asked about which threat group was behind the attack and whether they demanded a ransom "due to the ongoing investigations." While Odido has yet to attribute the attack, the ShinyHunters extortion gang has now added the company to its dark web leak site, claiming they've stolen nearly 21 million records containing data the company already revealed as exposed in the breach. ShinyHunters also told BleepingComputer on Monday that the stolen data also contains internal corporate data and plaintext passwords. However, an Odido spokesperson denied their claims in a statement to BleepingComputer, reiterating that "no passwords, call details, social security numbers, or billing data are involved." "This is a final warning to come back to our chat and finish what we set out to do before we leak along with several annoying (digital) problems that'll come your way," the extortion gang says on the leak site. "Make the right decision, don't be the next headline. You know where to find us." In recent weeks, ShinyHunters has claimed responsibility for a wave of other security breaches, including Panera Bread, Betterment, SoundCloud, Canada Goose, PornHub, and online dating giant Match Group (which owns the Tinder, Hinge, Meetic, Match.com, and OkCupid dating platforms). Some of their victims had their systems compromised in voice phishing (vishing) attacks targeting single sign-on (SSO) accounts at Google, Microsoft, and Okta, where the threat actors call employees while impersonating IT support staff and trick them into entering credentials and multi-factor authentication (MFA) codes on phishing sites that mimic their companies' login portals. As BleepingComputer first reported, the ShinyHunters group has also recently adopted device code vishing, abusing the OAuth 2.0 device authorization grant flow to obtain Microsoft Entra authentication tokens. After stealing their targets' credentials and auth codes, the threat actors hijack the victims' SSO accounts to breach connected enterprise services like Salesforce, Microsoft 365, Google Workspace, SAP, Slack, Adobe, Atlassian, Zendesk, Dropbox, and many others. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

New York-based ad tech company Optimizely has notified an undisclosed number of customers of a data breach after threat actors compromised some of its systems in a voice phishing attack. Optimizely has nearly 1,500 employees across 21 global offices, and its customer list includes over 10,000 businesses, including high-profile brands like H&M, PayPal, Zoom, Toyota, Vodafone, Shell, Salesforce, and Nike. In breach notification letters sent to affected customers, the company, the threat actors reached out on February 11, claiming they had access to its systems. Optimizely also told BleepingComputer that the attackers breached some of its systems and stole what it described as "basic business contact information." "The threat actor gained access to Optimizely's systems through a sophisticated voice-phishing attack, but was unable to escalate privileges, install software, or create any backdoors in the Optimizely environment, and we have no evidence that the threat actor was able to access sensitive customer data or personal information beyond basic business contact information," it said. Optimizely also noted the "incident was confined to certain internal business systems, records in our CRM, and a limited set of internal documents used for back-office operations," and added that its "business operations continue without disruption." The company also warned customers to be wary of attacks that could use some of the stolen data in further phishing attempts, which may use calls, texts, or emails to ask for passwords, MFA codes, or other credentials. ShinyHunters links While Optimizely didn't share how many customers had their information exposed in the data breach and has yet to name the threat actor behind the attack, it told affected customers that "the communication we received is consistent with the behavior of a loosely affiliated group who use sophisticated and aggressive social engineering tactics, most often involving voice phishing, to attempt to access their victims systems." This hints that the attackers are likely part of the ShinyHunters extortion operation, which has claimed similar breaches at Canada Goose, Panera Bread, Betterment, SoundCloud, PornHub, fintech firm Figure, and online dating giant Match Group (which owns multiple popular dating services, including Tinder, Hinge, Meetic, Match.com, and OkCupid) in recent weeks. While not all of these breaches are part of the same campaign, some victims had their systems compromised in a voice phishing (vishing) campaign targeting single sign-on (SSO) accounts at Microsoft, Okta, and Google across over 100 high-profile organizations. In these attacks, threat actors impersonate targets' IT support, call employees, and trick them into entering credentials and multi-factor authentication (MFA) codes on phishing sites mimicking their companies' login portals. As BleepingComputer first reported, the threat actors have also recently altered their social engineering attacks to use device code vishing, abusing the legitimate OAuth 2.0 device authorization grant flow to obtain Microsoft Entra authentication tokens. Once in, they hijack the victim's SSO account and gain access to connected enterprise services, including Salesforce, Microsoft 365, Google Workspace, Zendesk, Dropbox, SAP, Slack, Adobe, Atlassian, and many others. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Hackers have stolen the personal and contact information of nearly 1 million accounts after breaching the systems of Figure Technology Solutions, a self-described blockchain-native financial technology company. Founded in 2018, Figure uses the Provenance blockchain for lending, borrowing, and securities trading, and has unlocked over $22 billion in home equity with over 250 partners, including banks, credit unions, fintechs, and home improvement companies. While the blockchain lender didn't publicly disclose the incident, a Figure spokesperson told TechCrunch on Friday that the attackers stole "a limited number of files" in a social engineering attack. BleepingComputer has also reached out to Figure with further questions about the breach, but a response was not immediately available. Although the company has yet to share how many individuals were affected 967,200 accounts was stolen in the attack. "In February 2026, data obtained from the fintech lending platform Figure was publicly posted online," Have I Been Pwned said on Wednesday. "The exposed data, dating back to January 2026, contained over 900k unique email addresses along with names, phone numbers, physical addresses and dates of birth. Figure confirmed the incident and attributed it to a social engineering attack in which an employee was tricked into providing access." The ShinyHunters extortion group claimed responsibility for the breach and added the company to its dark web leak site, leaking 2.5GB of data allegedly stolen from thousands of loan applicants. In recent weeks, ShinyHunters claimed similar breaches at Canada Goose, Panera Bread, Betterment, SoundCloud, and PornHub. While not all of them are part of the same campaign, some of these victims were breached in a voice phishing (vishing) campaign targeting single sign-on (SSO) accounts at Okta, Microsoft, and Google across more than 100 high-profile organizations. The attackers are impersonating IT support, calling their targets' employees and tricking them into entering credentials and multi-factor authentication (MFA) codes on phishing sites that impersonate their companies' login portals. Once in, they gain access to the victim's SSO account, which provides them with access to other connected enterprise applications and services, including Salesforce, Microsoft 365, Google Workspace, SAP, Slack, Zendesk, Dropbox, Adobe, Atlassian, and many others. As part of this campaign, ShinyHunters also breached online dating giant Match Group, which owns multiple popular dating services, including Tinder, Hinge, Meetic, Match.com, and OkCupid. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

ShinyHunters flip the script on MFA in new data theft attacks Multi-factor authentication (MFA) is supposed to defend against phishing attacks, but threat actors operating under the ShinyHunters banner are using it as a pretext in ongoing social engineering attacks aimed at bypassing it. Among those successfully targeted in these latest hacking spree are Panera Bread, SoundCloud, Match Group (owner of online dating services Tinder, Hinge, Match and OkCupid) and Crunchbase. There will likely be many more victims, as Silent Push researchers detected active targeting or infrastructure preparation directed at domains of a wide variety of organizations in the tech and fintech, financial services, real estate, energy, healthcare, logistics, retail, and many other sectors. Synchronized vishing-phishing attacks Ten days ago, Okta warned about a new tool used by threat actors who specialize in voice phishing: custom-made phishing kits that allow them to syncronize the authentication flow on phishing pages with the request they make over the phone. “It’s worth noting that these hybrid phishing operations are also capable of bypassing push notifications that use number challenge/number matching as an additional method of verification,” Okta researchers noted. “A social engineer interacting on the phone with a targeted user can simply request a user to choose or enter a specific number.” Identifying the attack groups Mandiant, Google Cloud’s threat intelligence and incident response arm, says there are several seemingly independent groups that are using the same or a similar approach: UNC6661 and UNC6671. “In incidents spanning early to mid-January 2026, UNC6661 pretended to be IT staff and called employees at targeted victim organizations claiming that the company was updating MFA settings. The threat actor directed the employees to victim-branded credential harvesting sites to capture their SSO credentials and MFA codes, and then registered their own device for MFA. In at least some cases, the threat actor gained access to accounts belonging to Okta customers,” the researchers noted. The attackers moved laterally through victim customer environments to access various SaaS platforms and exfiltrate specific data from them: they searched for documents containing personally identifiable information, but also containing words such as “poc,” “confidential,” “internal,” “proposal,” “salesforce,” and “vpn”. In at least one incident where these attacker gained access to an Okta customer account, the group tried to minimize the possibility of detection by deleting a “Security method enrolled” email from Okta, and by deleting phishing emails sent from compromised email accounts to contacts working at cryptocurrency-focused companies. Around the same time, the UNC6671 threat actor impersonated IT staff over the phone and directed victims to enter their credentials and MFA authentication codes into phishing sites that were made to look like they belonged to their employer. Once they gained access to Okta customer accounts, the group leveraged PowerShell to download sensitive data from SharePoint and OneDrive. And after they made off with the data, during the extortion process, they used aggressive tactics such as harassing the victimized personnel. Based on details such as phishing domain hosting, Tox Chat accounts used for negotiation and other indicators, Mandiant researchers believe these are two separate groups or individuals. Based on overlapping tactics, techniques, and procedures used, UNC6661 can be tied to UNC6040, i.e., the ShinyHunters cyber extortion group. “GTIG also observed extortion text messages sent to employees and received reports of victim websites being targeted with distributed denial-of-service (DDoS) attacks,” the researchers also shared. The researchers have shared indicators of compromise related to the attacks as well as threat hunting queries. Mandiant has also published thorough guidance for organizations on how to avoid becoming a victim in these attacks, how to detect intrusions, and how to minimize the scope of the compromise if they do become a victim. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

The ShinyHunters ransomware group has claimed the theft of data containing 10 million records belonging to the Match Group and 14 million records from bakery-café chain Panera Bread. The Match Group, that runs multiple popular online dating services like Tinder, Match.com, Meetic, OkCupid, and Hinge has confirmed a cyber incident and is investigating the data breach. Panera Bread also confirmed that an incident occurred and has alerted authorities. “The data involved is contact information,” it said in an emailed statement to Reuters. ShinyHunters seems to be gaining access through Single-Sign-On (SSO) platforms and using voice-cloning techniques, which has resulted in a growing number of breaches across different companies. However, not all of these breaches have the same impact. The impact For the Match Group, ShinyHunters claims: “Over 10 million records of Hinge, Match, and OkCupid usage data from Appsflyer and hundreds of internal documents.” Match says there is no evidence that logins, financial data, or private chats were stolen, but Personally Identifiable Information (PII) and tracking data for some users are in scope. A notification process has been set in motion. For Panera Bread, ShinyHunters claims to have compromised 14 million records containing PII. Panera Bread reassures users that there is no indication that the hackers accessed user login credentials, financial information, or private communications. ShinyHunters also breached Bumblr, Carmax, and Edmunds among others, but I wanted to use Panera Bread and the Match Group as two examples that have very different consequences for users. When your activity on a dating app is compromised, the impact can be deeply personal. Concerns can range from partners, family members, or employers discovering dating profiles to the risk of doxxing. For many people, stigma around certain apps can lead to fears of being outed, accused of infidelity, or even extorted. The impact of the Panera Bread breach will be very different. “I just ordered a sandwich and now some criminals have my home address?” Data like this is useful to enrich existing data sets. And the more they know, the easier and better they can target you in phishing attempts. Protecting yourself after a data breach If you think you have been affected by a data breach, here are steps you can take to protect yourself: Check the company’s advice. Every breach is different, so check with the company to find out what’s happened and follow any specific advice it offers. Change your password. You can make a stolen password useless to thieves by changing it. Choose a strong password that you don’t use for anything else. Better yet, let a password manager choose one for you. Enable two-factor authentication (2FA). If you can, use a FIDO2-compliant hardware key, laptop, or phone as your second factor. Some forms of 2FA can be phished just as easily as a password, but 2FA that relies on a FIDO2 device can’t be phished. Watch out for impersonators. The thieves may contact you posing as the breached platform. Check the official website to see if it’s contacting victims and verify the identity of anyone who contacts you using a different communication channel. Take your time. Phishing attacks often impersonate people or brands you know, and use themes that require urgent attention, such as missed deliveries, account suspensions, and security alerts. Consider not storing your card details. It’s definitely more convenient to let sites remember your card details, but it increases risk if a retailer suffers a breach. Set up identity monitoring, which alerts you if your personal information is found being traded illegally online and helps you recover after. You can use Malwarebytes’ free Digital Footprint scan to find out if your private information is exposed online. Let’s face it, an incognito window can only do so much. Breaches, dark web trading, credit fraud. Malwarebytes Identity Theft Protection monitors for all of it, alerts you fast, and comes with identity theft insurance.

Dating-app giants investigate incidents after cybercriminals claim to steal data Dating app companies Bumble and Match Group recently responded to cybersecurity incidents that have been claimed by a well-known cybercrime group. Bumble said it contacted law enforcement after a contractor’s account was compromised in a phishing attack, resulting in what it described as brief unauthorized access to a small portion of its network. The company’s spokesperson told Bloomberg that the access had since been terminated and did not affect its member database, user accounts, the Bumble application, private messages or dating profiles. Match confirmed to Bloomberg earlier this week that it had experienced a cybersecurity incident involving a limited amount of user data and said it was notifying affected customers. A company spokesperson said there was no indication that login credentials, financial information or private communications were accessed. Bumble and Match did not respond to requests for comment from Recorded Future News. The ShinyHunters cybercrime group reportedly leaked thousands of internal Bumble documents, including files marked restricted or confidential, which they said were sourced primarily from Google Drive and Slack. ShinyHunters also claimed to have accessed 10 million records belonging to Match, which operates dating services including Tinder, Hinge and OkCupid. The group posted the claims on its dark web leak site. Researchers at Cybernews said they reviewed data samples attached to ShinyHunters’ post and found they included personal customer information, some employee details and internal corporate data. One sample linked to the Hinge dating app contained documents listing matches, along with roughly 100 records of matched users’ profile information, including names and biographical descriptions, the researchers said. Other files included lists of dating profiles and logs of profile changes, though some records did not clearly identify which app they belonged to and contained duplicated or test data. ShinyHunters is a financially motivated threat actor known for high-impact campaigns targeting major companies in the insurance, retail and aviation sectors. Earlier in September, the FBI warned that hackers linked to ShinyHunters were extorting organizations for large ransoms after stealing data from cloud software provider Salesforce. The group has also recently claimed an attack on data analytics firm Mixpanel, which it said allowed access to platforms such as Pornhub. Dating apps have increasingly become targets for cybercriminals due to the sensitive personal data they hold. In July, Tea — an app that allows women to anonymously review dates — said hackers accessed about 72,000 user images, including selfies submitted for identity verification. In September, Brazilian dating app Sapphos shut down after users discovered a flaw that reportedly exposed sensitive personal data. Daryna Antoniuk is a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in Eastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for Forbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.

Match Group, the owner of multiple popular online dating services, Tinder, Match.com, Meetic, OkCupid, and Hinge, confirmed a cybersecurity incident that compromised user data. The company stated that hackers stole a "limited amount of user data" after the ShinyHunters threat group leaked 1.7 GB of compressed files allegedly containing 10 million records of Hinge, Match, and OkCupid user information, as well as internal documents. In a statement to BleepingComputer, a spokesperson for Match Group confirmed the incident. "We are aware of claims being made online related to a recently identified security incident," the company spokesperson said. "Match Group takes the safety and security of our users seriously and acted quickly to terminate the unauthorized access." The company said the investigation into the incident is in progress with the help of external experts, and that there is no indication that the hackers accessed user log-in credentials, financial information, or private communications. "We believe the incident affects a limited amount of user data, and we are already in the process of notifying individuals, as appropriate," Match Group says. Match Group is a giant in online dating, generating annual revenue of $3.5 billion, and the active user base across all its apps is estimated to be more than 80 million. This latest incident is part of a new ShinyHunters voice phishing (vishing) campaign targeting single sign-on (SSO) accounts at Okta, Microsoft, and Google across over a hundred high-value organizations, using links to supposedly internal login portals. In the case of Match Group, BleepingComputer was told that the attacker stole data after compromising an Okta SSO account that gave them access to the company's AppsFlyer marketing analytics instance and Google Drive and Dropbox cloud storage accounts. However, the company disputed some of these claims in statement for BleepingComputer. A Match Group spokesperson said that "based on our investigation Google Drive and Dropbox files were not accessed." BleepingComputer has learned that the social engineering attack used the phishing domain at ‘matchinternal.com.’ The hackers said that the data contains personally identifiable information (PII), but not a lot of it. and that most of it consists of tracking information. Companies can add defenses against attacks based on social-engineering by implementing solutions that are resistant to phishing attempts. "While this is not the result of a security vulnerability in vendors’ products or infrastructure, we strongly recommend moving toward phishing-resistant MFA, such as FIDO2 security keys or passkeys where possible, as these protections are resistant to social engineering attacks in ways that push-based or SMS authentication are not," Charles Carmakal, Mandiant's Chief Technology Officer, says. Furthermore, "administrators should also implement strict app authorization policies and monitor logs for anomalous API activity or unauthorized device enrollments." In a post last week, Okta also recommends phishing resistance to prevent access to resources."When using Okta for workforce authentication, that would equate to enrolling users in Okta FastPass, passkeys or both for the sake of redundancy," says Moussa Diallo, threat researcher at Okta Threat Intelligence. "Social engineering actors can also be frustrated by setting network zones or tenant access control lists that deny access via the anonymizing services favoured by threat actors. The key is to know where your legitimate requests come from, and allowlist those networks,” Diallo said. The researcher notes that there are some financial institutions, like Monzo Bank and the Crypto exchange, currently testing live caller checks, where users can verify in the official mobile app from the company if an authorized representative is on the phone with them. Update [January 31st]: Article updated with statement from Match Group disputing that the threat actor accessed Google Drive and Dropbox storages during the attack. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report