Match Group Listed by shinyhunters Ransomware Group

On January 27, 2026, the shinyhunters ransomware group listed Match Group on its leak site, claiming to have exfiltrated 10 million records of internal files from the dating-app company behind Tinder, Hinge, and OkCupid.

What's Publicly Reported from Reporting

Public reporting indicates the incident is a ransomware attack in which shinyhunters say they stole internal documents. The group posted a sample of the alleged data and set an implicit deadline by warning Match Group to “PAY OR LEAK.” As of 28 January 2026 the listing remained active on the shinyhunters leak site hosted via ransomware.live. The exact number of people whose personal information is contained in the 10 million records has not been confirmed by Match Group, nor has the company issued a public statement detailing what specific data types were taken.

Why This Matters for You and Your Family

When a company that holds your dating profile, messages, phone number, email address, and payment details suffers a breach, the information rarely stays inside one app. Internal files often contain customer spreadsheets, support tickets, or analytics databases that link your online dating activity to your real-world identity. If those records reach the public leak site, anyone can download them and begin piecing together a profile of you or your adult children who use these services. The breach therefore moves from “corporate incident” to a direct privacy threat for millions of ordinary users and their households.

The Doxxing and Identity-Chain Implications

Ransomware groups like shinyhunters rarely stop at posting generic files. Once personal records appear on a leak site they frequently feed into larger doxxing chains: an email from the dump is cross-referenced with credentials stolen in earlier breaches, a phone number is sold on underground forums, and a dating username is linked to social-media accounts. These chains can lead to account takeovers on other platforms, including gaming services used by teenagers in the same household. Credential leaks of this nature therefore cascade quickly; a single exposed password reused across a dating app and a child’s Roblox or Fortnite account can result in full identity exposure.

ShyHunters’ Publicly Known Track Record

Public reporting attributes the shinyhunters group with emerging in 2020 and targeting a wide range of organizations, from online retailers to technology platforms. Notable prior victims have included Ticketmaster, Microsoft, and several cryptocurrency exchanges. Their typical playbook involves initial access through compromised credentials or vulnerabilities in third-party software, followed by exfiltration of internal databases and customer records. They then attempt extortion by threatening to publish the data on their leak site unless a ransom is paid. The group’s messages often adopt a taunting tone, as seen in the Match Group listing that lectured the company about “greed” and “moral high horse” decisions.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, dating usernames, and real identity so you can see exactly what chains exist before criminals exploit them.
• Rotate the password you used on any Match Group service anywhere it is reused, and switch on 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1 billion+ breach records and more than 100 platforms so the next leak that touches your family is flagged within hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often become the next link in the same doxxing chain.
• Let remediation specialists handle takedown requests across data brokers and leak sites for you while you focus on securing the exposed accounts.

The Match Group listing is a reminder that corporate breaches quickly become personal when names, contacts, and passwords escape into the open. Acting promptly on the exposed credentials and mapping your full identity chain can limit the damage before it spreads further. DoxxScan by GalaxyWarden delivers that continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage that includes children’s gaming accounts.