(07-08-26, 05:42 AM)exfilar Wrote:About the leak
Blurred — a US-based dating app with photo-blur reveal mechanics and 863 active users — left their production Firebase database completely open. Database: blurred-195721.firebaseio.com — no auth, no token, no referer check. Full read access. Anyone who types /.json at the end of the URL can dump the entire user database.
Inside: 861 email addresses (100% of users), 824 real names (95%), 826 birthdays with ages 18-74, 861 precise GPS coordinates (latitude/longitude to 14 decimal places), 786 FCM push notification tokens, gender identity + sexual orientation for every user, and profile photo URLs hosted in Firebase Storage. Full dating profiles with education, work history, conversation matches, and swipe history.
This is a dating app — the data is nuclear. GPS coordinates pinpoint users' homes, workplaces, and dating locations. Sexual orientation data. Private conversations between matched users. FCM tokens allow an attacker to push arbitrary notifications to 91% of the user base. This is stalker heaven and a privacy catastrophe.
The user base is heavily US: NYC (190), New York metro (102), Seattle (10), Los Angeles (5), Chicago (4), Miami (4). International users in Lagos (18), Accra (6), Toronto (6), and other African cities. Gender split: 405 male, 394 female, 14 nonbinary. The data is 100% real — verified profiles with signup dates, swipe counts, and active conversation logs.
Date: 06.08.2026
Format: Full Firebase RTDB JSON export + deep PII extraction + GPS coordinate dump
Users: 863 (861 with email, 824 with real names, 861 with GPS coordinates)
Emails: 861 unique (gmail 638, aol 58, icloud 57, yahoo 40, outlook 11, edu/corporate domains)
GPS Coordinates: 861 (latitude/longitude to 14 decimal places — pinpoint accuracy)
FCM Push Tokens: 786 (91% — push notification hijacking possible)
Profile Photos: 861 users with Firebase Storage image URLs
Ages: 18-74, average 31 (768 computed from birthdate timestamps)
Conversations: 23 active chat threads between matched users
Matches: 5 dating matches with full profile data
Date Proposals: 30 with GPS meeting coordinates and price negotiation
Invite Codes: 548 generated codes with creator/recipient tracking
Compromised Data Includes
email · first_name · last_name · birthday · age · gender · gender_pref (sexual orientation) · latitude · longitude · geohash · city_state · education · work · about · fcmToken · images (profile photo URLs) · fb_id · conversations · matches · swipe_count · last_login · min_age · max_age · max_distance · prompts · utc_offset_min · initialUser · score · notifications_match · notifications_message · notifications_daily_match · sneekPeakCount · genderOnProfile · locationDeclined
Affected Entities
Blurred Dating App — US-based dating platform with photo-blur reveal mechanics
863 individual dating app users — complete PII with precise GPS home/work coordinates
786 users with active FCM push tokens — push notification hijacking possible
23 conversation threads — private messages between matched users
5 confirmed dating matches — both parties' full profile data exposed
Geographic Breakdown
NYC / New York metro: 292 users (34%)
Lagos, Nigeria: 18 users
Seattle, WA: 10 users
Accra, Ghana: 6 users
Toronto, ON: 6 users
Surrey, BC: 5 users
Ibadan, Nigeria: 5 users
Los Angeles, CA: 5 users
Enugu, Nigeria: 4 users
Benin City, Nigeria: 4 users
Chicago, IL: 4 users
Brooklyn, NY: 4 users
Miami, FL: 4 users
+ 861 total city/state locations across 100+ cities
Infrastructure Map
firebase rtdb: blurred-195721.firebaseio.com — PUBLIC, read, no auth firebase storage: blurred-195721.appspot.com — profile photos hosted, URLs in user records Top-level keys (5): codes, conversations, dates, matches, users Database structure: - users → 863 user profiles with complete PII + GPS + FCM + photos - codes → 548 invite/referral codes with creator/recipient user IDs - conversations → 23 private chat threads with participant metadata - matches → 5 confirmed dating matches with both users' full profiles - dates → 30 date proposals with GPS meeting coordinates, price negotiation, and status tracking
Live Access Status (August 6, 2026)
firebase rtdb read — LIVE (no auth, anonymous HTTP GET on /.json)
firebase rtdb write — UNTESTED (likely writable based on open read pattern)
firebase storage — LIVE (profile photo URLs accessible, no auth on GET requests)
Sample Data — User Profiles with GPS Coordinates
Teju | [email protected] | female, straight | NYC, NY | 40.75984594843754, -73.99012586134411 | Age 33 Souaib Singer | [email protected] | male | Soa, Cameroon | Cameroon-based | Age 27 Grace john | [email protected] | female, straight | Tsaunin Kura, KD | Nigeria | Age 30 Serwaa | [email protected] | female, gay | NYC | 40.7598, -73.9901 | Age 42 Bg | [email protected] | female, bi | Kent, WA | 47.36865, -122.16701 | Age 23 David | [email protected] | male, straight | NYC | 40.7128, -74.0060 | Age 35
Sample Data — GPS Coordinates (pinpoint home/work locations)
40.75984594843754, -73.99012586134411 → Midtown Manhattan, NYC (Teju) 40.71277530000001, -74.0059728 → Lower Manhattan, NYC (David) 47.3686498, -122.1670067 → Kent, WA residential area (Bg) 33.7489954, -84.3879824 → Downtown Atlanta, GA 6.5243793, 3.3792057 → Surulere, Lagos, Nigeria
Sample Data — Sexual Orientation Breakdown
male_straight: 334 (39%) female_straight: 278 (32%) female_bi: 58 (7%) male_gay: 20 (2%) female_gay: 18 (2%) male_bi: 18 (2%) nonbinary_bi: 9 (1%) nonbinary_into_male: 3 select_bi: 1 nonbinary_into_female: 1
Sample Data — Non-Gmail Emails (223 total)
Sample Data — Active Conversations
Conversation -NKdSBGf1A5PiceAMHes: Participants include "Charles" Conversation -NKkeAJEY9G9CQGijjEE: Participants include "Charles" + 21 more conversation threads with participant names
Sample Data — Date Proposals with GPS Meeting Points
Date -NzL7-kk78wLZfppdEp0: Initiated by user, proposed GPS 40.7182,-73.9901, priceMax=$2, status=pending Date -NzL70MrTka6gCeZ6LE2: Confirmed at 1736958634229, expiration 1737045034229, Google photo URL included
What's in the dump
· blurred-195721_rtdb.json — complete Firebase RTDB export (5 top-level keys, 863 users) · blurred-195721_users.json — 863 user profiles with PII, GPS, FCM tokens · blurred-195721_emails.txt — 861 email addresses · blurred-195721_gps.csv — 861 GPS coordinate pairs with user IDs · blurred-195721_fcm_tokens.txt — 786 FCM push notification tokens · blurred-195721_names.txt — 824 real first names · blurred-195721_conversations.json — 23 chat threads with participant metadata · blurred-195721_matches.json — 5 dating matches with full profiles · blurred-195721_dates.json — 30 date proposals with GPS and pricing · blurred-195721_codes.json — 548 invite codes with creator tracking · blurred-195721_infrastructure_map.md — full architecture mapping Total: ~1.9MB raw / ~300KB compressed
Final word
This isn't a sophisticated exploit. This is a Firebase Realtime Database with the security rules set to true — the equivalent of leaving your dating app's entire user database on a public URL with no password. Google sends automated "your database is insecure" warnings to the Firebase project owner. The warnings were ignored.
Dating app data is the most dangerous category of PII breach. Unlike a retail site where you leak purchase history, a dating app leaks: who you are, where you live (GPS to 14 decimal places), what you look like (profile photos), who you're attracted to (sexual orientation), who you're talking to (private conversations), and where you're meeting them (GPS date coordinates). Every single field is sensitive. Combined, it's a stalking and blackmail toolkit.
The FCM push tokens are the most overlooked threat. An attacker with these tokens can send push notifications directly to 786 users' phones — fake match alerts, phishing links, extortion demands. No SMS gateway needed. No email deliverability issues. Direct to the notification bar.
863 users is a small database but the data density is 100%. Nearly every user has email, name, birthday, GPS, and photos. There are no empty profiles. These are real people who signed up, created profiles, and used the app. The 23 conversations, 5 matches, and 30 date proposals prove active usage.
The NYC concentration (34% of users) means a single city dominates the victim pool. 292 people in New York just had their dating profiles, GPS coordinates, and sexual orientations dumped on the internet.
Blurred Dating is 7/26 from the CredHarvest V6 pipeline — 32 exposed databases, 5 projects >100MB, 117 unique projects total. More drops from the pipeline soon. Same exploit. Different companies.
DOWNLOAD
Leaked via CredHarvest V6 pipeline — @exfilar| Drop from 06.08.2026
Thanks