Leak at Match Group (Hinge, Match, OKCupid)

On 29 January 2026, Match Group — the US dating-app conglomerate behind Hinge, Match and OKCupid — disclosed a data breach after attacker group ShinyHunters publicly claimed the theft of user records and internal files.

The intrusion did not exploit a software flaw. Attackers ran a voice phishing (vishing) campaign that tricked an employee into surrendering Okta single sign-on (SSO) credentials via a lookalike domain (matchinternal.com). With that access they reached internal dashboards, the AppsFlyer mobile-marketing platform and cloud storage, then exfiltrated data.

Exposed data categories reported for affected users include:

• First and last name, and login identifier
• Date of birth
• Phone number
• IP address and user-agent (device/tracking) data

Scale claims diverge sharply: ShinyHunters advertised roughly 10 million records and leaked about 1.7 GB of files, while the figure tied to this disclosure is 196,000 users; independently verified samples were smaller still. Match Group said it found no evidence that passwords, financial details or private messages were accessed, stating those were not stored in the compromised systems.

Match Group acted quickly to terminate the unauthorized access, engaged external investigators and began notifying affected individuals, leaving the incident contained but with the leaked dataset already circulating.