Match Group confirms intrusion after ShinyHunters claims 10 million Hinge, Match.com and OkCupid records
Match Group confirmed a security incident after ShinyHunters claimed 10M+ Hinge, Match.com and OkCupid records. Match says limited data; no passwords, payments or messages. Claimed total is unconfirmed.
Use a unique password and turn on multi-factor authentication for your Match Group accounts. Be wary of emails or texts that mention your profile or subscription, and check statements for unfamiliar subscription charges.
What’s happening
In late January 2026 the extortion group ShinyHunters claimed it had stolen more than 10 million records linked to Match Group's Hinge, Match.com and OkCupid apps, along with hundreds of internal documents. Match Group confirmed a recently identified security incident, said it moved to end the unauthorised access, and described the affected user data as limited. It said it had no indication that login credentials, financial information or private communications were accessed, and that it was notifying people as appropriate. It has not confirmed the claimed total, said what data types were taken, or said whether a ransom was demanded or paid. Samples reviewed by Cybernews reportedly included user IDs, IP addresses, location data and Hinge subscription records. The group pointed to AppsFlyer, a marketing analytics provider, as the source; AppsFlyer denied any compromise of its systems. The attack was reportedly voice phishing aimed at single sign-on logins, but that is alleged. A proposed class action was filed in Texas. As of the latest reporting found, the forensic investigation was described as ongoing, and no final outcome, leak confirmation or charges were found.
- What
- Breach
- Affects
- Match Group dating services (Hinge, Match.com, OkCupid)
- Fixed in
- Nothing to patch
- Since
- 28 Jan 2026
- Closed
- 24 Feb 2026
Timeline
- Update
A proposed class action, Kelechian v. Match Group (case 3:26-cv-00316, Northern District of Texas), was reported. It alleges the company failed to protect users' information. Only secondary reports of the filing were found; the docket was not checked.
- Update
UpGuard reported the alleged method as voice phishing of single sign-on credentials, and listed user IDs, IP addresses, Hinge subscription records and internal employee emails as the data reportedly involved. Match Group said it saw no sign that login credentials, financial information or private messages were accessed, and was notifying people as appropriate. It would not say how many people were affected or whether a ransom was demanded or paid.
- Made publicNothing to patch
The ShinyHunters extortion group listed a claim of more than 10 million records tied to Hinge, Match.com and OkCupid on its leak site, plus hundreds of internal documents. It named analytics provider AppsFlyer as the apparent source. Match Group confirmed a recently identified security incident and said a limited amount of user data was likely accessed.
- Update
Reporting places the start of the intrusion in mid-January; one report cited by search coverage gives 16 January as the date. UpGuard says unauthorised access may have begun in mid-January.
Sources
- ShinyHunters swipes right on 10M records in alleged dating app data grabThe Register · 29 Jan 2026
- Match Group Suffers Alleged Breach According to Dark Web ReportsUpGuard · 29 Jan 2026
- Match Group class action alleges data breach exposed user dataTop Class Actions · 24 Feb 2026