Hackers Didn’t Hack Tinder. They Called an Employee and Asked for the Password.

10 million dating profiles. Stolen. Not by cracking a server. Not by writing a single line of malicious code. By picking up a phone.

Let that sink in for a moment.

The company behind Tinder, Hinge, OkCupid, and Match.com — one of the largest dating platform empires on the planet — did not lose 10 million user records because a hacker found a zero-day vulnerability in their code.

They lost it because someone called an employee.

Pretended to be from IT support.

And that employee — doing exactly what most employees do when someone from “IT” calls — handed over the access.

No malware. No exploit. No dark magic.

Just a phone call.

What Was Actually Stolen

Before we get into how this happened, let’s talk about what “10 million dating app records” actually means in human terms.

This is not a list of email addresses and nothing else.

The stolen data includes user IDs, transaction details, IP addresses, dating profiles, and internal corporate documents.

Think about what that means for a real person.

Your dating profile is in there. The one with the photos you carefully selected. The bio you rewrote four times. Your age, your location, your preferences, your relationship history — summarized and packaged into a data file sitting on a criminal’s server.

When your activity on a dating app is compromised, the impact can be deeply personal. Concerns can range from partners, family members, or employers discovering dating profiles to the risk of doxxing. For many people, stigma around certain apps can lead to fears of being outed, accused of infidelity, or even extorted.

This is not “my credit card number got stolen.” This is your private life — the parts of it you didn’t share on LinkedIn or Instagram — now sitting in a criminal database.

And it happened because of a phone call.

The Attack Nobody Saw Coming — That Everyone Should Have

Here is the full story of how ShinyHunters, one of the most aggressive cybercriminal groups operating today, walked into one of the world’s largest tech companies without touching a single line of their security infrastructure.

PHASE 1 — RECONNAISSANCE ShinyHunters identifies Match Group employees on LinkedIn and company directories. IT support and helpdesk staff are targeted specifically. Voice profiles of legitimate IT personnel are studied and recorded.

PHASE 2 — THE PHONE CALL (Vishing) Attacker calls the target employee. AI voice cloning mimics a known IT staff member’s voice perfectly. Urgency is created: “Security incident — we need to verify your SSO credentials right now.” Employee complies and hands over Okta SSO credentials.

PHASE 3 — SSO COMPROMISE Okta Single Sign-On account is accessed. One login gives access to ALL connected platforms simultaneously. AppsFlyer marketing analytics platform is reached. Cloud storage and internal documents are opened.

PHASE 4 — DATA EXFILTRATION 10 million+ records downloaded silently. 1.7GB of compressed data extracted. Internal corporate documents copied. Zero alerts triggered — because legitimate credentials were used throughout.

PHASE 5 — DARK WEB POSTING Data posted on ShinyHunters dark web leak site. Match Group discovers the breach only after the criminal’s public announcement. Disclosure happens on the attacker’s timeline — not theirs.

The most chilling part of that attack chain?

At no point did any security system see anything wrong.

Every login was authenticated. Every credential was valid. Every access request came from a legitimate SSO session. The attacker was, as far as every security tool in Match Group’s stack was concerned, a legitimate employee doing their job.

The Weapon: Your Voice

This is the part of the story that most coverage has glossed over — and it is the part that should terrify every business owner and IT manager reading this.

ShinyHunters seems to be gaining access through Single-Sign-On platforms and using voice-cloning techniques, which has resulted in a growing number of breaches across different companies.

Voice cloning.

Not a fake email. Not a convincing text message. An AI-generated voice that sounds identical to someone the target employee knows and trusts — a colleague, an IT manager, a help desk technician.

You have been trained your whole career to spot phishing emails. Check the sender domain. Look for spelling mistakes. Hover over links. Do not click attachments from unknown senders.

Nobody trained you for this:

A phone call from your IT manager’s voice — his exact tone, his exact cadence, the same slight accent you’ve heard on every Teams call — telling you there’s an urgent security incident and he needs you to verify your credentials right now.

What do you do?

Most people hand over the credentials.

Because most people are not security researchers. They are accountants, marketers, customer service agents, and operations staff doing their jobs. When someone who sounds exactly like their IT manager calls and creates urgency around a security incident, compliance is the natural human response.

This is what ShinyHunters understood. And this is what made their campaign so devastatingly effective.

This Was Not a One-Time Attack

Match Group was not the only target.

ShinyHunters also breached Bumble, CarMax, and Edmunds among others — all in the same campaign, all using the same voice-cloning vishing technique targeting Okta SSO systems.

The pattern is now clear:

Find a company using Okta for Single Sign-On. Find an employee with broad access. Clone the voice of someone they trust. Call them. Get the credentials. One login — access to everything connected to that SSO.

Once inside, the attackers were able to reach marketing analytics tools and cloud-based storage services, illustrating once more how social engineering can bypass perimeter defenses and lead to secondary data exposure without breaching core systems.

This is the new playbook. And it works on companies that have:

• Firewalls ✓
• Endpoint protection ✓
• MFA enabled ✓
• Regular security training ✓
• Penetration testing ✓
• A full security team ✓

Because none of those things stop a phone call.

The SSO Problem Nobody Is Talking About

Here is the uncomfortable truth sitting underneath this entire story.

Single Sign-On was supposed to make security better. One strong login, one set of credentials, one place to enforce MFA and access policies. Better than 47 different passwords for 47 different systems.

And SSO is better — when those credentials stay secure.

But SSO has a catastrophic failure mode that nobody in the sales pitch ever mentions:

When SSO credentials are compromised, everything is compromised. Simultaneously.

One Okta login at Match Group gave ShinyHunters access to:

• AppsFlyer marketing analytics
• Cloud storage platforms
• Internal document systems
• Data from Hinge, Match.com, OkCupid, and more

One phone call. One credential. Everything.

The same logic applies to every business running SSO today — and that is most businesses. If your SSO credentials are stolen through vishing, your attacker does not need to hack anything else. They are already everywhere.

⚠️ Critical Warning: SSO is only as secure as the human who holds the credentials. Voice-cloning vishing attacks specifically target the human layer because it is the one layer that technical security controls cannot protect.

What You Need to Do Right Now

If your business uses Okta, Microsoft Entra ID, Google Workspace SSO, or any other Single Sign-On platform — this section is for you.

Step 1: Implement a verbal verification code system Every employee who might receive an IT call should have a personal verification code. If someone calls claiming to be from IT and cannot provide the code, the call is terminated immediately — no exceptions, no urgency overrides.

Step 2: Create a strict “IT will never call asking for credentials” policy Make this policy explicit, written, repeated, and tested. Legitimate IT teams do not need your password. If someone calls asking for credentials — regardless of who they claim to be — it is an attack.

Step 3: Enforce hardware-based FIDO2 MFA on all SSO accounts Standard MFA — SMS codes, authenticator apps — can be socially engineered away in the same phone call. Hardware security keys (FIDO2/WebAuthn) cannot be handed over verbally. They require physical possession.

Step 4: Limit SSO scope using least-privilege access If one compromised SSO credential gives access to every system in your organization, your blast radius is total. Segment access so that a compromised credential reaches only the systems that user legitimately needs.

Step 5: Run vishing simulation exercises You run phishing simulations. Run vishing simulations too. Call employees — using spoofed internal numbers — and attempt to extract credentials using social engineering. Track who complies. Train them specifically.

Step 6: Review third-party analytics and marketing tool access This suggests a supply chain attack where the direct servers of the dating apps may not have been breached, but the data sent to their analytics partner was compromised. Audit every third-party tool that has access to your user data. If a marketing analytics platform can see 10 million user records, that platform is a target.

The Real Lesson From Tinder’s Worst Day

The cybersecurity industry has spent thirty years building walls.

Firewalls. Intrusion detection systems. Endpoint protection. Zero Trust architecture. Multi-factor authentication. Penetration testing. Vulnerability scanners. SIEM platforms.

All of it — every dollar, every tool, every policy — is designed to stop attackers from breaking through the walls.

ShinyHunters did not break through the wall.

They called someone on the inside and asked them to open the door.

And the person on the inside — a normal employee doing their normal job — opened it.

This is the attack that no firewall blocks. No antivirus detects. No vulnerability scanner finds. No patch fixes.

The only defense is a human who knows, at a fundamental level, that no one from IT will ever call and ask for their password. And who holds that line even when the voice on the other end sounds exactly like their manager, even when the urgency feels completely real, even when every instinct says “this is legitimate.”

That kind of security does not come from technology.

It comes from training, culture, and relentless repetition of one simple rule:

Your credentials are yours. No one who calls asking for them is who they say they are.

Is Your Business’s Network Security Ready for What’s Coming?

The ShinyHunters campaign demonstrated that attackers no longer need to exploit your firewall, your VPN, or your endpoints. They exploit your people.

But that does not mean your network infrastructure does not matter. Once an attacker is inside using legitimate credentials, a properly segmented network — built on enterprise-grade firewalls with Zero Trust policies — is the last line of defense between “one compromised account” and “total breach.”

Jazz Cyber Shield supplies genuine Fortinet, SonicWall, and Cisco security hardware to businesses across the USA, UK, Canada, and Australia — the same enterprise-grade network security that creates the segmentation and access controls that limit what happens after a credential is compromised.

**Browse Network Security Hardware → jazzcybershield.com**

If this article made you immediately think about who in your organization might answer that phone call — clap. If you forwarded it to your IT team or your CEO — clap twice. If you’re about to implement a verbal verification code system before the end of the week — you already know what to do.