ADVERTISEMENT

1.2M messaging app profiles leaked online: Were you impacted?

Our researchers have found that Tokee, a video and text messaging app, has leaked users' records, including names and phone numbers.

tokee app data leak

Image by Cybernews.

Vilius Petkauskas
Vilius Petkauskas Deputy Editor
May 12, 2026 Updated: May 12, 2026 2 min read
Our researchers have found that Tokee, a video and text messaging app, has leaked users' records, including names and phone numbers. The exposed details create ample opportunities for threat actors to breach app users' privacy.
Key takeaways
  1. Tokee messaging app left a MongoDB database exposed, leaking 1.2M user profiles, phone numbers, avatars, and activity metadata.
  2. Researchers found Tokee chat messages were encrypted, but exposed personal data and metadata still created major privacy and security risks.
  3. The Tokee data leak could enable profiling, phishing, spam campaigns, and long-term reputational damage for the smaller messaging provider.
  4. This Tokee incident shows messaging app encryption is insufficient without robust infrastructure security and proper protection of user metadata.

Key Takeaways by nexos.ai, reviewed by Cybernews staff.

With messaging apps at the forefront of human interaction in the early 21st century, the security of communication is paramount. However, late last year, our team uncovered an exposed database, which researchers believe belongs to the Tokee platform.

The app has over 1M downloads on the Google Play Store, and is also available on Apple’s App Store, which doesn’t disclose the number of user downloads. The app was developed by Deucetek, a software company based in Atlanta’s metropolitan area.

According to the team, the Tokee data leak exposed around 1.2 million users, which likely represents the vast majority of the app's user base. The exposed database appears to have stored Tokee’s chat messages as well, but our researchers say the messages were encrypted.

More from Cybernews

Hand holding three Samsung Galaxy S26 FE in different colors.
Hackers crack Samsung Galaxy S26 and Pixel 10 with single email in zero-day attack
Security 2 min read
cat feeding planner app
Russian hackers hide spyware behind bizarre cat feeding planner
Security 2 min read
Smartphone displaying ASOS hack notification.
ASOS hack - rogue push alerts sent. Was your data stolen?
Security 3 min read
coffee machine keurig code
Coffee machine uses 1,000GB of traffic in 10 days, leaves IT Pro shocked
Security 3 min read
A black puzzle piece with a Firefox logo on it
Crypto theft campaign escalates on Firefox: 16 additional malicious extensions flagged
Security 1 min read
T-systems logo in the pink background with wired fence patterns
Hacker gang says it breached Deutsche Telekom’s IT arm
Security 2 min read
tokee data sample1
Sample of the leaked data. Image by Cybernews.

“Although user chat messages stored in the same infrastructure appear to be encrypted using password-based OpenSSL encryption, the exposed personal data alone presents significant privacy, security, and regulatory risks,” our researchers explained.

After the team contacted the company and the responsible authorities, the exposed database was taken offline. We have reached out to the app’s makers for comment and will update the article once we receive a reply.

jurgita color justinas color Izabele Pukenaite vilius color ernestas color gintaras color
Don't miss our latest stories on Google News. Add us as your Preferred Source on Google
Add us as your Preferred Source on Google.
Follow us

What Tokee user data was leaked online?

The exposed data was stored in the MongoDB database, a popular service businesses use to store and process large volumes of data. Multiple indicators pointed to the database being operated by Tokee.

The Firebase Storage URLs referenced Tokee project identifiers, the schema matched Tokee apps’ functionality, and field naming conventions aligned with the messaging-app’s user management.

tokee data sample2
Sample of the leaked data. Image by Cybernews.
ADVERTISEMENT

Meanwhile, the leaked data revealed information, such as:

  • User display names
  • Phone numbers (stored as numeric values)
  • Profile avatars (hosted on Firebase Storage)
  • Device tokens used for push notifications
  • User IDs
  • Account creation and update timestamps
  • “Last seen” activity indicators
  • Account status flags (e.g., premium/non-premium)
“Even when message content is encrypted, exposed metadata can reveal who communicates, when, and from where, undermining user privacy,” our team explained.
researchers said.

The team did not observe indications that threat actors exploited the exposed data, but if we were able to discover the database, others may have too. Threat actors operate numerous bots set up to specifically scour the net for exposed databases.

Attackers could exploit the data to track and profile user activity and use leaked tokens for targeted phishing and spam campaigns, increasing cybersecurity risks for app users.

tokee data sample3
Sample of the leaked data. Image by Cybernews.

Check if your data was exposed

Find out if your email and related personal information have appeared in known data breaches.

“For smaller messaging providers like Tokee, such incidents carry outsized reputational impact, potentially affecting user trust, adoption, and long-term viability. The case also reinforces that encryption alone is insufficient without proper infrastructure security,” our researchers concluded.

Messaging app leaks are particularly risky, as malicious actors target more prominent market players to peddle malware. Having large amounts of app users’ metadata only makes attackers’ work easier.

Disclosure timeline:

Leak discovered: December 3rd, 2025
Initial disclosure: December 3rd, 2025
Leak closed: January 19th, 2026

Unlock more exclusive Cybernews content on YouTube.

ADVERTISEMENT