Bumble Data Breach 2026, Bumble Sued After Data Breach Allegedly Exposed Users’ PII

A class action lawsuit filed in federal court accuses Bumble of failing to protect millions of users’ personal information during a data breach that occurred in January 2026. The lawsuit alleges the breach was preventable and that Bumble’s security practices fell below industry standards. Here is what happened, what the lawsuit claims, and what affected users should know.

What Happened?

In January 2026, Bumble confirmed a data breach after the hacking group ShinyHunters infiltrated its internal Slack and Google Drive systems, leaking 30GB of corporate files.

The breach was first brought to light on January 29, 2026, when ShinyHunters allegedly posted stolen data to a dark web leak site. Unlike traditional breaches that target user databases directly, this breach focused on internal corporate infrastructure. The hackers reportedly used a “vishing” (voice phishing) attack to compromise a contractor’s account, gaining access to Bumble’s internal group lists.

Vishing — short for voice phishing — is a social engineering tactic where hackers impersonate trusted individuals over the phone to trick employees or contractors into handing over access credentials. The lawsuit argues this type of attack is well-known and that Bumble should have had safeguards in place to prevent it.

What Data Was Allegedly Exposed?

The complaint alleges the compromised information included names, dates of birth, addresses, telephone numbers, Social Security numbers, and account numbers, as well as highly sensitive dating data such as chat history and dating history.

The complaint states that the January 2026 cyberattack was conducted by ShinyHunters, which was allegedly responsible for past data breaches on SoundCloud, Ticketmaster, AT&T, and several others. According to the filing, ShinyHunters has released a sample of the stolen data to the dark web.

The combination of personal identifiers and intimate dating history makes this breach particularly serious. Once that type of data is on the dark web, it can be used for identity theft, fraud, extortion, or targeted harassment.

What Does Bumble Say?

Bumble responded to the incident by stating its InfoSec team “quickly detected and eliminated the access,” contained the breach, engaged external cybersecurity experts, and notified law enforcement. The company emphasized that no member database, accounts, direct messages, or profiles were accessed.

The gap between Bumble’s public statements and what plaintiffs allege is at the center of the lawsuit. Plaintiffs argue that even if user profiles were not directly accessed, the breach of internal systems containing sensitive PII is sufficient to establish harm and liability.

Bumble Wasn’t Alone — Match Group Was Also Hit

This breach was broader than just Bumble. Match Group, parent of Tinder, Hinge, and OkCupid, was also impacted, with approximately 10 million records containing personally identifiable information compromised. Match Group noted that logins, financial data, and private messages were not exposed and said it would notify affected users if private data was involved.

The involvement of multiple major dating platforms in a single attack underscores how attractive these companies are as targets, given the volume and sensitivity of personal data they hold.

Related article: McCain Foods Recalls 650K Pounds Tater Tot Recall, What You Need to Know About the Plastic Contamination

What Does the Lawsuit Claim?

Plaintiff Tyra Omirin claims Bumble failed to ensure that the PII it obtained from customers was maintained in a manner consistent with industry standards, statute, and regulation.

The lack of cybersecurity safeguards in Bumble’s servers is alleged to amount to a violation of the Texas Deceptive Trade Practices Act and Federal Trade Commission Act, given the company’s representation that it would protect collected information against “loss, misuse, and unauthorized access or sharing.”

The lawsuit also claims negligence, breach of implied contract, breach of the implied covenant of good faith and fair dealing, and unjust enrichment. The plaintiff is seeking damages, a jury trial, and a court order requiring Bumble to overhaul its security systems and delete exposed PII.

This Isn’t Bumble’s First Data Breach

This is not the first time Bumble has faced legal action over data security. One lawsuit was filed in 2022 after a 2020 data breach — it ultimately went to arbitration, as stipulated in the app’s terms of service.

That arbitration clause remains active and could significantly affect the 2026 lawsuit. Bumble’s terms of service state that the arbitration agreement “will, with limited exceptions, require disputes between us to be submitted to binding and final arbitration.” If the court enforces this clause, the case may never proceed as a class action in federal court — a major obstacle plaintiffs will need to overcome.

What Are the Long-Term Risks for Affected Users?

The lawsuit emphasizes that “once PII is stolen, particularly identification numbers, fraudulent use of that information and damage to victims may continue for years.”

Following the breach, the plaintiff reported spending time exploring credit monitoring and identity theft insurance options, self-monitoring personal and financial accounts, and seeking legal counsel — all of which her attorneys argue constitute real, compensable injury.

Dating app breaches carry unique risks beyond typical financial fraud. Exposed location data, behavioral patterns, and dating history can be used for targeted harassment or extortion — harms that are difficult to quantify but can be deeply disruptive.

What Should Affected Users Do Now?

If you used Bumble and are concerned about the January 2026 breach, there are practical steps worth taking regardless of any legal outcome:

• Monitor your credit reports through AnnualCreditReport.com and consider placing a free credit freeze with all three major bureaus (Equifax, Experian, TransUnion).
• Watch for phishing attempts — your name, address, and phone number being exposed means you may receive targeted scam calls or emails.
• Document everything — keep records of any suspicious activity, unusual account access, or fraudulent charges.
• Review Bumble’s terms of service — specifically the arbitration clause, which may affect your legal options if you consider pursuing a claim.
• Consult a qualified attorney if you believe you have been harmed. A consumer protection or data privacy attorney can assess your specific situation.

FAQs

What is the Bumble data breach lawsuit about? 

A class action filed in federal court in Texas alleges Bumble failed to adequately protect users’ personal information during a January 2026 cyberattack by the hacking group ShinyHunters. The lawsuit claims Bumble’s security practices were below industry standards and that the breach was preventable.

What personal information was allegedly exposed? 

According to the lawsuit, the compromised data may include full names, dates of birth, addresses, phone numbers, Social Security numbers, account numbers, chat history, and dating history.

Who is ShinyHunters? 

ShinyHunters is a known hacking group previously linked to major data breaches at Ticketmaster, AT&T, SoundCloud, and other companies. The group reportedly posted a sample of stolen Bumble data to a dark web site in January 2026.

Did Bumble confirm the breach? 

Yes. Bumble confirmed a breach occurred but stated that its security team quickly contained it and that no member profiles, direct messages, or accounts were accessed. Plaintiffs dispute the scope of that characterization.

Could Bumble’s arbitration clause block the lawsuit? 

Possibly. Bumble’s terms of service include a mandatory arbitration clause that has previously been used to move disputes out of court. Whether a court enforces that clause in this case is a key legal question that has not yet been resolved.

Was any other dating app affected? 

Yes. Match Group, which owns Tinder, Hinge, and OkCupid, was reportedly also impacted by the same breach, with approximately 10 million records potentially compromised.

What should I do if I think my data was exposed? 

Consider placing a credit freeze, monitoring your accounts for unusual activity, and documenting any suspicious communications. Consulting a data privacy attorney can help you understand whether you may have legal options.

Disclaimer: This article is for informational purposes only and does not constitute legal advice. Laws and legal procedures vary by jurisdiction and may change over time. For advice regarding a specific situation, consult a qualified attorney or the appropriate authority.

About the Author

Sarah Klein, JD, is a licensed attorney and legal content strategist with over 12 years of experience across civil, criminal, family, and regulatory law. At All About Lawyer, she covers a wide range of legal topics — from high-profile lawsuits and courtroom stories to state traffic laws and everyday legal questions — all with a focus on accuracy, clarity, and public understanding.
Her writing blends real legal insight with plain-English explanations, helping readers stay informed and legally aware.
Read more about Sarah