Millions of (very) private chats exposed by two AI companion apps

According to Cybernews, two AI companion apps, Chattee Chat – AI Companion and GiMe Chat – AI Companion, exposed millions of private conversations from more than 400,000 users. The data included 43 million messages and over 600,000 images and videos, with IP addresses and unique device identifiers also exposed.

The incident stemmed from a publicly exposed and unprotected Kafka Broker instance used to handle real-time data streams for the apps, which were available on Android and iOS, and the exposure occurred because there were no authentication or access controls. Chattee was particularly popular, with over 300,000 downloads largely in the US, and both apps were developed by Imagime Interactive Limited, a Hong Kong-based company.

The researchers described the breach as not requiring sophisticated hacking and warned that intimate conversations may not be as private as claimed, potentially enabling risks such as sextortion. The leak has since been closed following responsible disclosure.