Bumble Lawsuit Claims Dating App Failed to Prevent ‘Massive’ January 2026 Data Breach

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action lawsuit alleges Bumble is responsible for a “massive and preventable” January 2026 data breach that reportedly saw cybercriminals exfiltrate more than 30 gigabytes of files containing sensitive user information.

Want to stay in the loop on class action lawsuits that matter to you? Sign up for ClassAction.org’s free weekly newsletter.

The 37-page data breach lawsuit contends that the dating app failed to ensure that the personal information in its care—including full names, dates of birth, Social Security numbers, dating preferences and more—was adequately protected from unauthorized access.

The Bumble data breach lawsuit argues that consumers who handed over their personally identifiable information in order to use the dating app expected that their data would be adequately protected and disclosed only under authorized circumstances. The case accuses Bumble of “intentionally, willfully, recklessly and/or negligently” failing to have in place reasonable cybersecurity standards and, as a result, enabling unauthorized groups to access the data.

Per the filing, the 2026 Bumble data breach stemmed from a phishing attack, which the suit says indicates that the app’s data security was “not up to par.”

“[Bumble] could have prevented the Data Breach, by properly securing and encrypting and/or more securely encrypting its servers generally, as well as Plaintiff and Class Members’ PII,” the suit charges. “Additionally, that the Data Breach was caused by a phishing attack indicates that Defendant’s data security was not up to par.”

The complaint states that the January 2026 cyberattack was conducted by a hacker group known as ShinyHunters, which was allegedly responsible for past data breaches on SoundCloud, Ticketmaster, AT&T and several others.

According to the filing, ShinyHunters has released a sample of the stolen data to the dark web.

Once in the hands of cybercriminals, stolen personal information is often released for sale on the dark web, where it becomes a tool susceptible to facilitating identity theft, fraud and other criminal behavior, the suit relays.

“The ramifications of Defendant’s failure to keep secure Plaintiff’s and Class Members’ PII are long lasting and severe,” the case emphasizes. “Once PII is stolen, particularly identification numbers, fraudulent use of that information and damage to victims may continue for years.”

According to the filing, the lack of cybersecurity safeguards in Bumble’s servers amounts to a violation of the Texas Deceptive Trade Practices Act and Federal Trade Commission Act, given the company’s representation that it would protect collected information against “loss, misuse, and unauthorized access or sharing.”

Based on the value of consumers’ personally identifiable information, Bumble knew or should have known the importance of protecting the data within its servers, and users of the dating app reasonably assumed that this would be the case, the suit maintains.

“Most of the reported data breaches are a result of lax security and the failure to create or enforce appropriate security policies, rules and procedures,” the complaint notes.

The Bumble class action lawsuit seeks to represent all individuals whose personally identifiable information was stored by Bumble and was exposed to unauthorized third parties as a result of the data breach that occurred in or around January 2026.

Check out ClassAction.org’s free legal resources to learn how to start a class action lawsuit.