Grindr Dark Web Breach: 15 Million Records Include HIV Status and Location

The Grindr data breach dark web listing contains field-level data that extends far beyond the scope of a standard credential dump. Most breach datasets trade on names, email addresses, and hashed passwords. The alleged Grindr dataset includes medical and behavioral data that users cannot change after exposure.

Each of the 15 million records allegedly contains: username and display name, first and last name, email address, bcrypt password hash, phone number hash, gender identity, sexual orientation, date of birth, city and country, precise GPS latitude and longitude coordinates, HIV status, date of the user's last HIV test, self-declared physical attributes including height, weight, body type, and ethnicity, signup IP address, device type and model, browser user agent, operating system locale, account status (active, banned, verified), premium subscription tier, and account creation and last activity timestamps.

Bcrypt password hashes are computationally expensive to crack compared to MD5 or SHA-1, but they are not immune to targeted attacks. Standard bcrypt with cost factor 10 takes approximately 100 milliseconds per attempt on a modern GPU. A targeted attack against specific accounts using password lists from prior breach compilations, known as credential stuffing, can succeed against accounts where the password appears in previously leaked datasets. Attackers acquiring this database can run targeted offline cracking against high-value individuals rather than attempting to crack all 15 million hashes simultaneously.

The combination of HIV status and precise GPS coordinates in a single record creates a data category that most breach risk frameworks do not adequately address: a dataset that simultaneously enables physical location, medical outing, and account takeover in a single $400 purchase.

The mechanism behind the Grindr data breach dark web listing has not been confirmed by Grindr or independent researchers as of June 4, 2026. Security researchers examining the sample data have identified three plausible extraction paths based on the field types present in the alleged dataset.

Direct database compromise would require bypassing Grindr's network perimeter, authentication controls, and database access restrictions. The presence of internal fields including account status flags, subscription tier data, and bcrypt password hashes, none of which are exposed in Grindr's published API documentation, is consistent with direct database read access rather than API-based collection.

Third-party vendor compromise is a plausible alternative. ShinyHunters, the threat group responsible for the Charter Communications and Canvas LMS data breaches in 2026, used voice phishing to compromise employee identity credentials and then exported records from connected Salesforce instances containing customer data. A similar approach targeting a Grindr analytics, CRM, or data warehousing vendor with access to production user records could yield a dataset with the field coverage seen in this listing without requiring direct access to Grindr's core infrastructure. For context on how this attack pattern works in practice, see the ShinyHunters vishing Salesforce campaign analysis.

Insider extraction, while statistically less common than external compromise, cannot be ruled out given the dataset's completeness and the structured schema that mirrors a database export. A privileged employee with DBA or data science access could produce an output matching the described layout.

The $400 asking price, low for a dataset of this sensitivity and scale, may indicate the data has already been shared within criminal networks prior to this public listing, reducing its novelty value for resale and explaining the reduced price.

Most data breaches expose data that victims can change: passwords can be reset, credit cards can be canceled, email addresses can be abandoned. The Grindr data breach dark web listing includes two data categories that cannot be changed: HIV status and sexual orientation. A third field, GPS coordinates, enables physical harm that no technical remediation can undo.

HIV status exposure creates legal, employment, and personal safety consequences that persist indefinitely. HIV-positive status is protected health information under HIPAA for US residents and under GDPR Article 9 as a special category of health data for EU residents. Exposure of that status to an employer, family member, or social circle can cause discrimination, relationship breakdown, and physical danger in regions where HIV-positive status carries significant stigma or legal implications. No patch addresses an HIV status disclosure.

Sexual orientation exposure carries parallel risks. Grindr's user base is LGBTQ+. Users of the platform in countries where same-sex relationships are criminalized face legal consequences and physical danger if their orientation becomes known to governments, employers, families, or communities. A $400 dataset that identifies 15 million people by name, email, and sexual orientation is a ready-made targeting list for homophobic actors, authoritarian intelligence agencies, and blackmail operations.

GPS coordinates expose users to physical surveillance and targeted approach. Precise latitude and longitude at the time of app use places a named, identified individual at specific physical locations. For users who accessed Grindr from a home, workplace, or frequent location, this field effectively reveals their address and daily movement pattern to any buyer of the dataset.

The broader context of credential exposure in 2026, including the analysis in 16 billion credentials on the dark web, shows that datasets like this one are cross-referenced against prior breach compilations to build comprehensive target profiles within hours of acquisition.

The threat actor posting the Grindr data on a dark web forum operates under the alias 'nilojeda'. Minimal public attribution information is available for this identity. Dark web forum aliases are frequently disposable, with threat actors rotating handles after a high-profile listing to reduce attribution exposure. The $400 asking price in multiple cryptocurrencies (Litecoin, Ethereum, USDC, and Tether) is standard for forum-based data transactions but unusually low for a dataset with this level of sensitive health and location data.

Dark Web Informer, an independent threat intelligence monitoring account, posted independently verified forum screenshots of the listing on June 2, 2026, confirming the post appeared on an active underground marketplace. DailyDarkWeb corroborated the listing within hours, citing the same data fields and price point.

The low asking price creates two distinct risk scenarios. In the first, the data has already circulated within a closed criminal network and the $400 forum listing represents a final monetization pass after initial buyers extracted value. In the second, the threat actor is attempting to establish reputation on the forum by offering a high-impact dataset at an accessible price, expecting volume sales to compensate for the low per-unit price.

No attribution to any known threat group has been made by security researchers as of June 4, 2026. The combination of health data and precise location targeting in a single dataset is consistent with the collection priorities of state-level intelligence programs from nations where same-sex relationships are criminalized, but no confirmed state attribution has been established. Criminal extortion, corporate espionage, and data resale remain the most likely motivations at this price point.

Verifying whether your personal data appears in the Grindr data breach dark web listing requires monitoring services because Grindr has not disclosed the breach or established a victim notification portal as of June 4, 2026. Three immediate verification steps are available.

Search Have I Been Pwned at haveibeenpwned.com using the email address registered to your Grindr account. When the Grindr breach is confirmed and indexed by HIBP, affected accounts will appear in search results. HIBP, operated by security researcher Troy Hunt and trusted by major organizations including the UK National Cyber Security Centre, is the most comprehensive public breach notification service available and is free to use. Submit every email address that may be associated with a Grindr account.

Enable dark web monitoring through your password manager or identity protection service. Services including 1Password Watchtower, Dashlane Dark Web Monitoring, and Norton LifeLock actively scan dark web forums and marketplaces for email addresses and phone numbers. The Grindr listing may surface in these tools as researchers index and add the dataset to their monitoring databases.

Contact Grindr directly through the app or at grindr.com to request information about whether your account was involved in a data security incident. Companies subject to GDPR are required to notify affected users within 72 hours of confirming a breach of personal data. Grindr has not issued any statement as of June 4, 2026. If you are an EU resident, you have the right to file a complaint with your national data protection authority if Grindr does not respond within a reasonable period.

Delete your Grindr account if you are no longer an active user. Account deletion removes your data from Grindr's active user database, limiting future exposure from this breach or subsequent incidents. Use the in-app account deletion option under Settings, not just app uninstall, to trigger a formal deletion request under applicable privacy regulations.

These steps address the specific exposure risks created by the Grindr data breach dark web listing. Complete them in order, starting with the actions that reduce the highest-probability attack vectors.

Security teams typically classify Grindr as a consumer application outside their threat model. The June 2, 2026 dark web listing changes that assessment for organizations in three sectors: defense and government contracting, financial services, and any employer subject to blackmail-based insider threat risk.

The data in this listing enables targeted social engineering and blackmail operations against named, identified individuals. A threat actor with the full Grindr dataset can identify employees at specific organizations by cross-referencing exposed email addresses against corporate domain patterns. An employee whose HIV status, sexual orientation, home location, and password hash are all in a single $400 database is a structurally compromised target for coercion before any attack has begun.

Defense and government contractors face the highest risk. Security clearance adjudication in the United States and allied nations includes personal conduct and health factors that can affect clearance eligibility. Employees at cleared organizations who appear in this dataset face potential scrutiny if the data is acquired by a foreign intelligence service. Multiple nations that criminalize same-sex relationships operate active intelligence programs targeting Western defense contractors and government personnel.

Financial services organizations subject to SOX, PCI-DSS, or equivalent controls should evaluate whether an employee's presence in this breach creates a reportable insider threat risk under their data governance frameworks.

Practical response for security teams: cross-reference your corporate email domain against breach notification services when the Grindr dataset is indexed. Employees who used corporate email addresses to register personal Grindr accounts are identifiable from the breach data alone. Any employee identified in this manner should receive a confidential notification and cybersecurity counseling, without disciplinary implications, so they can take immediate protective action.