# Match Group's Security Failures: A Board-Level Emergency > By DII Regulatory Monitor | Published: 2025-08-27T00:00:00+00:00 | Section: Regulatory Monitor | Source: https://www.datingindustryinsights.com/news/study-finds-dating-apps-cybersecurity-risks | Publisher: Dating Industry Insights (High Intent Media Inc) 75% of top dating apps score poorly on security. With rising breaches, operators must prioritize protection or face severe consequences. ## Key points - A cybersecurity audit by the Business Digital Index revealed that 18 out of 24 popular dating apps scored D or F grades for data protection. - Only Bumble and EliteSingles achieved B grades for security infrastructure, whilst 18 competing platforms failed to implement basic email security protocols. - Match Group recorded an average revenue per paying user of $16.37 in Q3 2024, despite charging subscription fees up to £40 monthly without basic safeguards. - Niche dating platforms charging between £8.99 and £24.99 per month remain particularly vulnerable to external cyberattacks, as demonstrated by the recent Tea app breach. ## Article - 18 of 24 popular dating apps scored D or F grades for data protection in new cybersecurity audit - Match Group 's average revenue per paying user reached $16.37 in Q3 2024, up 5% year-over-year - Premium dating subscriptions cost £15-£40 per month yet lack basic email security protocols standard in banking - Only Bumble and EliteSingles achieved B grades for security infrastructure Match Group's platforms are charging users £15 to £40 per month for premium subscriptions, yet the majority are failing to meet basic digital security standards. A new cybersecurity audit reveals that [18 of the 24 most popular dating apps scored D or F grades for data protection](https://www.globaldatinginsights.com/featured/study-finds-75-of-dating-apps-pose-cybersecurity-risks/), raising uncomfortable questions about where all that subscription revenue is actually going. The analysis, conducted by the Business Digital Index, evaluated dating platforms on email security protocols including SPF, DMARC, and DKIM authentication—technical infrastructure that prevents phishing attacks and email spoofing. Digital security and data protection concept ### The DII Take > This is the cost of the industry's obsession with growth metrics over operational excellence. Dating operators have spent the past five years bolting on AI features, launching video dating, and A/B testing paywall copy whilst neglecting the unglamorous backend work that actually protects members. When a breach happens—and with security this poor, it's when, not if—the reputational damage will make the current trust crisis look mild. Any operator still scoring D or F should be treating this as a board-level emergency. ### Premium pricing, bargain-bin protection The disconnect between pricing and security investment is stark. Match Group disclosed in its Q3 2024 earnings that average revenue per paying user across its portfolio reached $16.37, up 5% year-over-year. Bumble's premium tier costs £32.99 per month in the UK. Subscribers are paying for profile boosts and unlimited likes whilst the platforms collecting their data fail to implement email authentication that costs virtually nothing to deploy. Email security might sound technical, but the implications are concrete. Without proper SPF, DMARC, and DKIM protocols, attackers can send convincing phishing emails that appear to come from legitimate dating platforms. Users click through, enter credentials, and hand over account access. This isn't theoretical—Dropbox suffered a major breach in 2022 after employees fell for phishing emails. The data at risk goes well beyond payment details. Dating profiles contain sexual orientation, political views, location history, private messages, and photographs. Many platforms track granular behavioural data: when users are most active, who they message, how quickly they respond. For LGBTQ+ users, particularly those in less accepting environments, a breach could expose information they've specifically chosen to keep private. Cybersecurity threats facing online platforms ### The niche platform problem Bumble's B grade is notable, but it's also the platform with a $1.39B market capitalisation and dedicated security resources. The greater concern is the proliferation of niche dating apps—platforms targeting specific communities, interests, or demographics—that collect equally sensitive data without comparable infrastructure. The recent breach of Tea, a dating app for Asian singles, exposed the full scope of this vulnerability. Attackers accessed user data and held it for ransom. The platform serves a specific community with particular privacy concerns around cultural expectations and family dynamics. Yet like many niche operators, it lacks the security budget that larger platforms take for granted. > This creates a two-tier system where users on smaller platforms face disproportionate risk despite paying similar subscription fees. A quick scan of niche dating apps shows monthly subscriptions ranging from £8.99 to £24.99—not dramatically cheaper than mainstream alternatives, yet the security investment doesn't scale proportionally. Smaller operators are competing on features and community, not backend infrastructure, because users can't see the difference until something goes wrong. The economics are challenging but not impossible—implementing proper email authentication doesn't require massive capital expenditure, it requires prioritisation. ### What compliance teams should be asking Dating operators tend to focus security efforts on trust and safety—content moderation, fake profile detection, romance scam prevention. These are critical functions, but they address user-generated threats. Email security failures expose platforms to external attacks that compromise entire databases at once. For compliance teams, particularly those preparing for the UK Online Safety Act and EU Digital Services Act, this audit should trigger immediate internal reviews. Both regulatory frameworks include [data protection requirements and user safety provisions](https://thecyphere.com/blog/privacy-security-concerns-in-dating-apps/). A platform that can't implement basic email authentication is poorly positioned to demonstrate compliance with more complex obligations. Data protection and regulatory compliance The business risk extends beyond regulatory fines. Dating apps operate on trust. Members share intimate information because they believe it will remain private. When breaches occur, they don't just lose individual users—they trigger media coverage that damages the entire brand. Bumble has invested heavily in positioning itself as the safer, more women-friendly alternative to [Tinder](https://www.datingindustryinsights.com/news/tinder-names-vccp-uk-social-agency). That brand equity evaporates quickly if user data ends up for sale on dark web forums. Investors should be asking pointed questions about security spending as a percentage of revenue. If a platform is growing revenue per user but security infrastructure isn't growing in parallel, the risk profile is worsening even as financial metrics improve. This is particularly relevant for Match Group, which has been optimising for margin expansion. Where is the line between operational efficiency and dangerous underinvestment? The audit methodology deserves scrutiny—the Business Digital Index isn't a household name in security research, and the grading criteria warrant independent verification. But the underlying findings align with broader industry patterns. Dating operators have prioritised growth, engagement, and monetisation whilst treating security as a compliance checkbox rather than a competitive advantage. That calculation is about to change. As [breaches become more frequent](https://complexdiscovery.com/dating-app-breach-exposes-900k-users-a-wake-up-call-for-cybersecurity/) and regulatory scrutiny intensifies, security will shift from backend concern to front-page crisis. The platforms still scoring D and F have a narrow window to fix this before the market forces them to explain why they didn't. - Dating platforms face a critical choice between immediate security investment and inevitable reputational crisis as regulatory frameworks tighten - Investors must scrutinise security spending as percentage of revenue—margin expansion without parallel infrastructure growth signals mounting risk - The security gap between well-funded platforms and niche operators creates systematic vulnerability for underserved communities paying comparable subscription fees ## Key takeaways - Dating app investors must evaluate backend security expenditure alongside revenue growth, as margin expansion without technical infrastructure upgrades increases long-term reputational risk. - Compliance teams preparing for the UK Online Safety Act and EU Digital Services Act must audit email authentication protocols to meet stricter regulatory requirements. - Dating app operators should prioritise basic cybersecurity infrastructure over new surface-level feature additions to prevent database-wide phishing breaches and preserve user trust. ## FAQ ### Which dating apps passed the Business Digital Index cybersecurity audit? Only Bumble and EliteSingles received B grades for security infrastructure in the Business Digital Index audit, whilst 18 other evaluated dating apps failed. ### What was Match Group's average revenue per paying user in Q3 2024? Match Group reported an average revenue per paying user of $16.37 in Q3 2024, representing a 5% increase year-over-year. ### How much do premium subscriptions on Match Group and Bumble cost in the UK? Match Group platforms charge between £15 and £40 per month for premium subscriptions, while Bumble charges £32.99 per month in the UK. ### What cybersecurity regulations affect dating app compliance teams in Europe? Dating app compliance teams in Europe must align their data protection protocols with the UK Online Safety Act and the EU Digital Services Act. --- Canonical: https://www.datingindustryinsights.com/news/study-finds-dating-apps-cybersecurity-risks Citation: "Dating Industry Insights" (https://www.datingindustryinsights.com)