Lovora Couples App Breach Exposes Nearly 500 K User Profiles
What Happened
In February 2026 the Lovola (Lovora) relationship‑matching app suffered a breach that compromised 495,556 user accounts. The exposed data set includes each user’s email address, display name, and profile photo. Plantake, the company behind the app, has not responded to outreach attempts for comment.
Why It Matters for Compliance & Audit Readiness
- Demonstrates the need for continuous control‑assurance over third‑party SaaS applications that store personally identifiable information (PII).
- Highlights the importance of maintaining up‑to‑date data‑classification inventories and evidence of encryption or tokenization controls for email addresses and images.
- Reinforces that incident‑response documentation and vendor‑risk attestations must be readily available for audit inquiries under frameworks such as NIST CSF, ISO 27001, and GDPR.
Who Is Affected
- Consumer mobile‑app providers (dating, relationship, social networking).
- SaaS platforms that collect and store user‑generated media.
- Organizations that integrate Lovora data for marketing or analytics.
Recommended Actions
- Review any contractual or data‑processing relationships with Lovora/Plantake.
- Verify that monitoring controls (e.g., anomalous‑access alerts, data‑loss‑prevention) are active for all third‑party integrations.
- Request a formal incident‑response report from the vendor and update your breach‑notification procedures accordingly.
- Re‑assess encryption and access‑control safeguards for stored email addresses and profile images.
Technical Notes
- Attack vector: Not disclosed; breach likely involved unauthorized access to the app’s backend storage.
- CVEs: None reported.
- Data types exposed: Email addresses, display names, profile photos (user‑generated images).