Quitbro App Breach Exposes 22,874 User Accounts
What Happened – In February 2026 the Quitbro porn‑addiction app (operated by Plantake) suffered a data breach that released a dataset containing 22,874 unique email addresses, partial dates of birth, usernames and self‑reported relapse times. The vendor did not respond to multiple outreach attempts.
Why It Matters for Trust & Control Assurance
- The incident illustrates a failure to enforce privacy‑control assurance practices such as documented consent, data‑minimisation and regular evidence collection.
- Continuous monitoring of data‑access and retention of audit‑ready privacy artifacts would have provided early detection and defensible proof for regulators.
- Aligns with the control objective of privacy and data‑protection governance, a single control that maps to many frameworks (e.g., GDPR, CCPA, NIST CSF).
Who Is Affected – Users of health‑ and wellness‑focused mobile applications; SaaS providers handling sensitive personal data.
Recommended Actions
- Review and update privacy policies to ensure a lawful basis for processing and clear consent records.
- Deploy continuous monitoring of data‑access logs and retain evidence of privacy‑control enforcement for audit readiness.
- Conduct a gap analysis against GDPR/CCPA privacy controls and remediate any deficiencies.
Technical Notes – The breach source and attack vector were not disclosed; no specific vulnerability (CVE) was identified. Exposed data types: email addresses, year of birth, usernames, and relapse‑time responses. Source: Have I Been Pwned – Quitbro breach