> ## Content Index > Fetch the complete content index at: https://www.privacyguides.org/llms.txt > Use this file to discover other available public pages before exploring further. # Data Breach Roundup (Jan 23 – Jan 29, 2026) - URL: https://www.privacyguides.org/news/2026/01/30/data-breach-roundup-jan-23-jan-29-2026/ - Published: 2026-01-30T16:10:26.000Z - Updated: 2026-01-30T16:10:26.000Z - Description: This week saw a massive leak from a likely infostealer database, two AI products, an app to help users quit porn, and updates to Soundcloud and the French unemployment agency. - Author: Nate Bartram - Tags: News Briefs, Data Breaches Want to stay informed? Get the data breach roundup delivered straight to your inbox every week! New and current subscribers can now adjust your newsletter settings to get subscribed. [Subscribe to emails ](#/portal) ## 149 Million Usernames and Passwords Exposed by Unsecured Database Credentials were for Gmail, iCloud, TikTok, Facebook, OnlyFans, Binance, multiple countries' government systems, banks, and more. It was unclear who the database belonged to, so researcher Jeremiah Fowler notified the hosting provider, who took it down as a Terms of Service violation. He said he believes the database was due to an infostealer and that it was growing during his attempts to get it taken down, highlighting that perhaps infostealers are starting to become a bigger problem. [149 Million Usernames and Passwords Exposed by Unsecured DatabaseThis “dream wish list for criminals” includes millions of Gmail, Facebook, banking logins, and more. The researcher who discovered it suspects they were collected using infostealing malware.![](https://www.privacyguides.org/content/images/icon/favicon-19.ico)WIREDLily Hay Newman![](https://www.privacyguides.org/content/images/thumbnail/sec-passwords-leak-1300258740.jpg)](https://www.wired.com/story/149-million-stolen-usernames-passwords/) ## App for Quitting Porn Leaked Users' Masturbation Habits An unnamed app for designed to help users abstain from watching porn is leaking the data of over 600,000 users, 100,000 of whom claim to be minors. The data includes age, how often they masturbate, and how viewing porn makes them feel. The developer initially said he would fix the issue quickly, but has since denied that there is any vulnerability. The author notes that the vulnerability exists in Google Firebase, which frequently has these sort of vulnerabilities. They compare it to how Amazon's S3 used to suffer from poor defaults that frequently resulted in data breaches. [App for Quitting Porn Leaked Users’ Masturbation HabitsHundreds of thousands of users told the app intimate details about their sexual urges, which are now exposed.![](https://www.privacyguides.org/content/images/icon/favicon-3-6.svg)404 MediaEmanuel Maiberg![](https://www.privacyguides.org/content/images/thumbnail/photo-1543794215-cbc7905029fa)](https://www.404media.co/app-for-quitting-porn-leaked-users-masturbation-habits/) ## Hackers Say They've Hacked Match Group, Maker of Hinge, OkCupid The attackers were able to get access by using voice phishing on Okta. From there there were able to collect data from other third parties like Doordash, AppsFlyer, and translation services. The stolen data appears to include mostly internal documents but also some users' unique advertising IDs. [Hackers Say They’ve Hacked Match Group, Maker of Hinge, OkCupidMatch Group says it is investigating claims that a mass of internal data was hacked from its popular dating apps.![](https://www.privacyguides.org/content/images/icon/favicon-3-7.svg)404 MediaJoseph Cox![](https://www.privacyguides.org/content/images/thumbnail/photo-1643639779224-03e4cfabc3cd)](https://www.404media.co/match-group-hacked-tinder-okcupid-hinge/) ## Massive AI Chat App Leaked Millions of Users Private Conversations We're living in the golden age of Firebase misconfiguration breaches. "Chat & Ask AI" - an app that claims 50 million users - has had private messages with chatbots exposed. The leaked messages include troubling prompts like how to cook meth, to write a suicide note, or how to hack various apps. The attacker claims he was able to access over 300 million messages from over 25 million users. The data included complete chat history, timestamps of messages, the name users gave to their chatbots, and which model it used (ChatGPT, Claude, Gemini, etc). On the plus side, the company fixed the issue within hours of disclosure. [Massive AI Chat App Leaked Millions of Users Private ConversationsChat & Ask AI, which claims 50 million users, exposed private chats about suicide and making meth.![](https://www.privacyguides.org/content/images/icon/favicon-3-8.svg)404 MediaEmanuel Maiberg![](https://www.privacyguides.org/content/images/thumbnail/photo-1496814795703-e5b242546673)](https://www.404media.co/massive-ai-chat-app-leaked-millions-of-users-private-conversations/) ## An AI Toy Exposed 50,000 Logs of Its Chats With Kids to Anyone With a Gmail Account A researcher found they were able to log into Bondu's public-facing web console using a Google username and could access children's names, birth dates, family member names, "objectives” for the child chosen by a parent, and detailed summaries and transcripts of every previous chat between the child and their Bondu. The company took the portal down "in a matter of minutes" and relaunched it the next day with proper authentication. [An AI Toy Exposed 50,000 Logs of Its Chats With Kids to Anyone With a Gmail AccountAI chat toy company Bondu left its web console almost entirely unprotected. Researchers who accessed it found nearly all the conversations children had with the company’s stuffed animals.![](https://www.privacyguides.org/content/images/icon/favicon-21.ico)WIREDAndy Greenberg![](https://www.privacyguides.org/content/images/thumbnail/012826-AI-toy-children-chat-3.jpg)](https://www.wired.com/story/an-ai-toy-exposed-50000-logs-of-its-chats-with-kids-to-anyone-with-a-gmail-account/) ## Have I Been Pwned: SoundCloud data breach impacts 29.8 million accounts Back in [December](https://www.privacyguides.org/news/2025/12/20/data-breach-roundup-dec-12-dec-18-2025/), we shared that SoundCloud had suffered a data breach but little information was known at the time. Thanks to Have I Been Pwned, we now know that nearly 30 million users had their email addresses, geographic locations, names, usernames, avatars, and profile statistics scraped from the site. [Have I Been Pwned: SoundCloud data breach impacts 29.8 million accountsHackers have stolen the personal and contact information belonging to over 29.8 million SoundCloud user accounts after breaching the audio streaming platform’s systems.![](https://www.privacyguides.org/content/images/icon/apple-touch-icon-39.png)BleepingComputerSergiu Gatlan![](https://www.privacyguides.org/content/images/thumbnail/soundcloud-1.jpg)](https://www.bleepingcomputer.com/news/security/have-i-been-pwned-soundcloud-data-breach-impacts-298-million-accounts/) ## France fines unemployment agency €5 million over data breach Back in March 2024, France's unemployment agency (France Travail, formerly Pôle Emploi) suffered a data breach that exposed the personal information of job seekers from the past 20 years, including names, dates of birth, national insurance numbers, email and home address, and phone number. Now CNIL (France's data protection office, among other things) has issued a nearly €6 million fine. [France fines unemployment agency €5 million over data breachThe French data protection authority fined the national employment agency €5 million (nearly €6 million) for failing to secure job seekers’ data, which allowed hackers to steal the personal information of 43 million people.![](https://www.privacyguides.org/content/images/icon/apple-touch-icon-41.png)BleepingComputerSergiu Gatlan![](https://www.privacyguides.org/content/images/thumbnail/French_flag.jpg)](https://www.bleepingcomputer.com/news/security/france-fines-unemployment-agency-5-million-over-data-breach/)