Match Group Data Breach: Hinge User Data
The Match Group data breach was a January 2026 incident in which a threat group used social engineering to obtain limited unauthorized access to the company's corporate network and certain internal tools.
Exposed Data Types
3- Email addresses
- Personal information
- Device usage tracking data
About This Breach
Match Group confirmed in a regulatory filing that limited user data was affected.
Public reporting connects the incident to usage and marketing-analytics data associated with Hinge, Match and OkCupid. The company said it found no indication that user login credentials, financial information or private communications were accessed.
How did the incident happen?
According to Match Group's filing with the U.S. Securities and Exchange Commission, the attackers used social engineering to enter the corporate network. Independent technical reporting says a corporate account provided access to an AppsFlyer marketing-analytics environment.
The company said it terminated the unauthorized access and investigated with external experts. Match Group disputed the attacker's claim that Google Drive and Dropbox files were accessed.
What information was affected?
The confirmed scope includes limited user information and tracking or marketing-analytics data describing app usage. Source-scope evidence tied to the incident also supports the presence of email addresses.
Match Group reported no evidence that login credentials, financial information or private communications were accessed. Those categories are therefore not included in this breach record.
How many people were affected?
The company did not disclose a total number of affected people. The threat actor's figure of 10 million refers to usage records, not a verified number of unique individuals.
The affected-person count is therefore recorded as unknown. Repeated source records and email-formatted values were not converted into a people count.
What risks could the data create?
Email addresses combined with dating-app usage context may increase the risk of targeted phishing, account impersonation and unwanted personal association.
Tracking data is not the same as private-message content, but it may still provide context about app activity and campaign interactions. The incident is therefore treated as sensitive.
What did Match Group do?
The company said it terminated the access, investigated with outside experts and began notifying individuals where appropriate. Its regulatory filing also says the incident did not have a material adverse effect on the company's business results.
What should users do?
People who receive an official notice from a Match Group application should check the affected data types stated in their own notice. Unexpected emails containing app-usage or campaign details should be verified before opening links.
Although the company found no evidence that login credentials were accessed, users who reuse passwords should adopt unique passwords and enable multi-factor authentication.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
