Lovora Data Breach (2026): What Was Exposed & What To Do

In February 2026, the relationship app Lovora was reported to have suffered a data breach affecting 496,000 unique email addresses. The exposed records also included display names and profile photos, along with other personal information collected through normal use of the service. The incident was made public on 25 February 2026; the company behind the app, Plantake, did not respond to repeated inquiries about the event.

The breach is significant because it involves a service that stores intimate personal details. Even without confirmation of more sensitive fields, the confirmed data types allow direct contact and identification of individuals who used the platform.

What happened

Public reporting on 25 February 2026 stated that Lovora had exposed 496,000 unique email addresses. The same records contained users’ display names and profile photos. Additional personal information gathered by the app was also described as present, though the precise fields beyond the three named categories have not been itemised in available reports. No official statement from Plantake has confirmed or denied the incident, and the company has not disclosed when the exposure began or how long the data remained accessible.

How a breach like this happens

Applications that store user profiles commonly keep the information in central databases accessible to authorised services. Unauthorised access can occur through compromised credentials, misconfigured storage systems, or vulnerabilities in the code that handles authentication and data retrieval. Once an attacker obtains a copy of the database or its exports, the records can be published or sold without the operator’s knowledge. In many cases the first public sign of such an event is the appearance of the data on forums or data-aggregation sites rather than an announcement from the affected organisation.

Who is Lovora?

Lovora is a mobile application designed for couples and people seeking relationships. Like other services in this category, it collects profile information, contact details, and usage data to match and connect users. The parent company, Plantake, operates the platform but has not published detailed information about its infrastructure or data-handling practices in connection with this incident. A breach at a relationship app is consequential because the user base often includes individuals who prefer to keep their participation private.

What data was at risk

The reported records include display names, email addresses, and profile photos. Additional personal information collected through app use is mentioned in summaries of the incident, but the exact categories have not been confirmed. Organisations of this type routinely hold account-creation details, device identifiers, and interaction logs; whether any of those fields were present in the exposed set remains unverified.

What's at stake

Individuals whose email addresses and names appeared in the data can expect an increase in unsolicited messages. Profile photos paired with contact information make it straightforward to locate the same people on other platforms. For the organisation, the absence of a public response leaves users without clear guidance on whether accounts should be changed or deleted. Over time, the data may be combined with other leaks, gradually building more complete profiles of affected users.

What to do if you're exposed

Anyone who used Lovora should treat the email address associated with the account as potentially public. Changing passwords on that address and on any other services that reuse it reduces the chance of account takeover. Enabling two-factor authentication wherever possible adds a further barrier. Users can also run a free exposure scan of their email address against known breach data sets to see whether their information appears in this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.