cybersecurity in dating apps

Growing concerns about cybersecurity in dating apps

Generic placeholder image
Matt McKenna

Underwriting Manager

Vulnerabilities have been discovered in some popular dating apps.

What lessons can other businesses take away?

Anyone who uses an app assumes that there’s a certain amount of privacy involved. This isn’t unique to dating apps. Consumers accept that the app marketplace and/or developer will collect usage and error data and certain forms of personally identifiable information.

What they don’t expect is that unauthorized third parties will be able to view and even control user experience on the app.

That’s the exact situation that dating app Tinder is dealing with right now. One flaw in the mobile app’s security gave some creative hackers a point of entry. Then they were able to view the pictures a user was looking and even track the user’s swipes.

In theory, a bad actor could sell this info, use it for blackmail or who knows what else.

But they’re not alone, as the Hustle noted. Several other dating apps have been called out for vulnerabilities in their geo-location system. Hackers were actually able to physically locate users despite deliberate efforts from the companies to hide GPS data.

Cybersecurity in dating apps is the topic of the day but every company with an online presence bears similar risks. What can they learn from Tinder’s experience?


Spotting vulnerabilities is a constant battle

It’s a marathon, not a sprint, and companies use various methods to address this. Third party security firms and bug bounties have emerged as valuable solutions.

Tinder is well aware of the ongoing threat:

In a statement to WIRED, a Tinder spokesperson wrote that “like every other technology company, we are constantly improving our defenses in the battle against malicious hackers,” and pointed out that Tinder profile photos are public to begin with. (Though user interactions with those photos, like swipes and matches, are not.) The spokesperson added that the web-based version of Tinder is in fact HTTPS-encrypted, with plans to offer those protections more broadly. “We are working towards encrypting images on our app experience as well,” the spokesperson said.

This shows us two things: 1) fixes take time and 2) no plan is foolproof.


Vulnerabilities will be found and exploited, and they can be expensive to fix.

Whether it’s by you, bad actors or white hat hackers who want to raise awareness/promote their services, vulnerabilities will be found. The goal is for you to find them first so you can avoid bad press, or much worse.

In the case of Tinder, the problem is a clear vulnerability in their protocol: they use HTTP instead of HTTPS encryption. Pretty simple. But not all vulnerabilities will be so clear. The costs of finding and fixing these vary on a case-by-case basis. (One cyber security expert estimated an average cost of $28,000 to repair all of the bugs on a website.)


Insurance can protect you from data breaches when all else fails

Year after year, high-profile data breaches are showing us that companies who are proactive about cyber security are investing in their future. The cost of failure is simply too high.

By the time insurance enters the picture, the vulnerabilities have been found and exploited by bad actors. Now is the time for damage control.

Cyber insurance offers two main protections after a data beach happens:

  1. Paying the costs of defending you from certain suits and investigations.
  2. Reimbursing the company for certain direct expenses that arise.

Policies often include limits for defense costs, regulatory investigations, PCI compliance fines and expenses, breach notification costs, PR and crisis management consultation and the costs of maintaining a call center and credit monitoring for affected users. And these are just the basics in terms of protections available from carriers today. More nuanced and advanced coverages can be tailored to special risks.


Want to know more?

You can contact us at or create an account here in order to get a quote for cyber insurance.

Want to read more on the subject?  Check out our other blog posts on cyber insurance.

Related Articles

Cybersecurity quiz
April 25 • Cyber Liability

Cybersecurity Stats of 2022: Data Protection Pro or Novice? [Quiz]

Cybersecurity concerns skyrocketed during the past few years, especially for small businesses and technology companies — but how cyber literate are we really? Let’s find out!

March 22 • Cyber Liability

How “Dark Patterns” Impact Data Protection

Dark patterns are everywhere, from confusing ecommerce checkouts to unsubscribe links — and they impact data protection. Let’s talk about it.

Cyber Liability Insurance Trends 2022
February 22 • Cyber LiabilitySpotlight

Cyber Liability Insurance Trends 2022

After an exceptionally rough year in cybersecurity, let’s review cyber liability insurance trends to expect in 2022.

cyber liability_crime_insurance
October 12 • Crime InsuranceCyber Liability

What’s the Difference Between Crime and Cyber Insurance?

Plenty of overlap occurs between crime and cyber liability insurance. Let’s review the similarities and differences in these policies for startups, or even small business or mid-market company.

August 31 • Cyber Liability

Cyber Liability Insurance Guide

Cyber liability insurance can seem confusing — but it doesn’t have to be. Here are several crucial cyber coverage guidelines for startups and technology companies.

August 30 • Cyber LiabilityErrors & OmissionsRisk Management Tips

Managed Service Providers (MSPs) Insurance Guide

With the environment rapidly changing for a small or mid-market business, what risks do MSPs face now? Here’s a practical guide to MSP insurance.