- A cybercriminal claims to be selling a database containing more than 100 million alleged Bumble user records.
- The advertised dataset reportedly includes personal details, profile information, and account activity metadata, although no one has verified the claims.
- Security experts urge users to stay cautious while Bumble has yet to comment on the alleged listing.
A threat actor just claimed to possess a massive database containing information belonging to more than 100 million alleged Bumble users. It is a dating platform, Bumble.
The seller listed the dataset on a cybercrime forum and is asking $450 for access. A threat intelligence account, Daily Dark Web on X, brought this report.
The forum advertisement states that the database contains exactly 100,232,002 unique records stored in JSONL format. However, no independent cybersecurity firm has confirmed the authenticity of the dataset. There is also no public evidence showing Bumble experienced a new data breach.
Even without verification, the listing has attracted attention because of the amount of information the seller claims to possess. If genuine, the database could expose highly personal information that criminals often exploit.
Threat Actor Claims Database Contains Extensive User Information
According to the advertisement shared online, the alleged database contains far more than basic account details. The threat actor claims the records include user IDs, profile IDs, first and last names, email addresses, phone numbers, gender, dates of birth, age, and location information.
The seller also alleges the database contains relationship preferences, profile descriptions, education history, schools attended, and employment information. Additional fields reportedly include profile photographs, verification status, social media connection indicators, premium subscription details, conversation counts, swipe statistics, match history, and account activity metadata.
If those claims prove accurate, the dataset would offer criminals a detailed picture of each affected user. Unlike many credential leaks that only expose usernames and passwords, dating platform records often reveal personal interests, habits, and behavioral information.
According to cybersecurity experts, advertisements on underground forums should not automatically be viewed as proof that a successful breach occurred. Independent validation remains necessary before anyone can confirm the legitimacy, freshness, or origin of the advertised data.
The same caution applies to other unverified claims; a hacker has claimed to be selling an alleged employee database from Shree Transport
Previous Bumble Incident Remains Unrelated
The latest listing also arrives during increased scrutiny surrounding cybersecurity within the online dating industry. Earlier this year, reports linked Bumble and Match Group to a cyberattack allegedly associated with the ShinyHunters hacking group. That incident generated widespread concern after attackers reportedly compromised an employee’s account through a phishing campaign.
Bumble later addressed the incident publicly. The company explained that attackers accessed an employee account through phishing but found no evidence that member databases were compromised. The company also stated there was no indication that user accounts, direct messages, or financial information were affected during that incident.
At this stage, security researchers have found no evidence connecting that earlier phishing attack to the newly advertised database. Both incidents remain separate, and investigators have not established any relationship between them.
As of publication, Bumble has not released a public statement addressing the latest marketplace listing. Likewise, no independent cybersecurity organization has verified that the advertised records originated from Bumble’s systems.
Experts Advise Users to Stay Alert Until Claims are Verified
Although the alleged breach remains unconfirmed, cybersecurity professionals recommend taking precautionary steps rather than waiting for official confirmation. Users should enable multi-factor authentication whenever the service supports it. This additional security layer can help prevent unauthorized account access even if passwords become exposed elsewhere.
Experts also recommend creating unique passwords for every online account. Reusing passwords across multiple services significantly increases the impact of any future data exposure. People should also watch carefully for suspicious emails, phone calls, or text messages that reference personal information. Criminals often use leaked details to make phishing attempts appear legitimate.
Users should avoid clicking unexpected links or responding to unsolicited messages requesting personal or financial information. Instead, they should contact companies directly through official channels whenever they receive suspicious communications. For now, cybersecurity researchers continue treating the advertised Bumble database as an unverified threat intelligence report.
