Nisarga Adhikary says he gained access to secret data and private chat images on Indian dating app

Nisarga Adhikary, who became famous for discovering security flaws in the CBSE Online Submission of Marks portal, has now claimed that he was able to access sensitive information of a multi-million-dollar Indian dating app. In a post on X, the 19-year-old wrote that he gained access to the app’s S3 buckets, users’ media files, sensitive infrastructure information and even private keys. He further claimed in the post that the vulnerabilities in the app were flagged by a researcher who goes by the handle @0x1622 two years ago, but no action was taken.

“There’s an India-based dating app with a multi-million-dollar valuation. I gained full access to its S3 buckets, every user’s media (including private chat images), signing keys, private keys and other sensitive infrastructure secrets/information," he wrote. The "AWS keys were not even rotated" after the other cybersecurity researcher flagged the issue.

Nisarga said that he reached out to the founders of the dating app, but they did not respond to his emails. However, CERT-In acknowledged his security report, and he was given a reference number. In a later update, he informed that the company's “CTO responded after this tweet and confirmed that they are working to patch the vulnerabilities. They have rotated the AWS access keys.”

Social media users react to dating app break-in

Netizens have some "pun" reactions to his post. One user wrote, "Congrats on discovering the app’s love letters, now can you swipe right on fixing the security." Another said, "Wow, you just turned a dating app into a reality show, and not the cute kind. Guess the only swipe left now is from the cops." One asked, "private chat images!!?" Another quipped, "What a guy does after getting rejected."

One user slammed companies for taking the easy route to make money without actually caring about their users. "Most of these companies aim is to get exorbitant valuations by hook or crook, make lifetime money with a partial exit. They don't aim to make great products," one wrote.

Nisarga Adhikary hired by IIT Kanpur

Notably, the young cybersecurity researcher had also discovered multiple security weaknesses in the CBSE portal, warning that sensitive student and school-related information could be exploited by crooks. His 17-year-old associate and fellow student researcher, Sarthak Sidhant, appeared before the Parliamentary Standing Committee that investigated the matter. He was hired by IIT Kanpur recently and appointed as an OSINT and Threat Intelligence Engineer at C3iHub, the cybersecurity and cyber defence research centre.