MeetMindful, a U.S.-based niche dating platform focused on mindfulness, wellness, and intentional-living compatibility, suffered a data breach in approximately early 2020 that was publicly disclosed in January 2021 when the data-extortion group ShinyHunters posted a 320-megabyte archive of MeetMindful user data to the cybercrime forum RaidForums on January 20, 2021. The leaked file was made available as a free download on a publicly accessible hacking forum. Co-owner Keith Gruen issued a security notice on January 24, 2021 acknowledging the breach and stating that ShinyHunters had exploited a now-closed vulnerability in MeetMindful's systems to export data on users who had signed up before March 2020.

The breach affected approximately 1.4 million unique customer email addresses based on records indexed by Have I Been Pwned and approximately 2.28 million user records based on contemporaneous reporting by ZDNet and other outlets. Compromised fields included names, email addresses, dates of birth, gender, sexual orientation, religion, geographic location data including precise latitude and longitude, IP addresses, marital status, physical attributes, drinking habits, drug habits, smoking habits, partner-gender preferences, social media profile linkages, Facebook user IDs and authentication tokens (described by MeetMindful as long-expired), usernames, and passwords stored as bcrypt hashes. The bcrypt password storage represents modern cryptographic practice, though weak or commonly used passwords may still be recoverable with sustained computational effort.

For affected users, the practical risk profile is exceptionally severe and varies substantially across the affected population because the field set is unusually sensitive. The combination of name, email, date of birth, precise geographic location, and bcrypt-hashed password supports both credential-stuffing attacks against other accounts and physical-identification risk because users can be matched to specific neighborhoods. More distinctively, the disclosure of sexual orientation, religion, marital status, and drug or alcohol habits creates targeted harassment, doxxing, and extortion risk that varies significantly across user populations. LGBTQ+ users in jurisdictions with hostile environments may face elevated personal-safety and employment risk. Users in religious communities may face family or community consequences. Users whose disclosed substance habits could affect employment or family relationships may face additional consequences. Affected users who receive extortion attempts should not pay ransom demands because payment does not stop further extortion. Users should change any reused passwords on other accounts, enable two-factor authentication where available, document any extortion communications, and report extortion attempts to law enforcement. LGBTQ+ users with personal-safety concerns may benefit from contacting LGBTQ+ advocacy organizations including the Trevor Project (1-866-488-7386) for confidential support resources.

Niche dating platforms collect highly sensitive profile data, relationship intent, demographic details, photos, messages, and account credentials tied to personal compatibility and romantic interest.

MeetMindful's operational status appears to have been declining before the January 2021 breach disclosure. The platform's social media accounts on Facebook, Twitter, and Instagram had not posted any new content since approximately April 2020, and the Android and iOS apps had not been updated since the winter of 2020. MeetMindful co-owner Keith Gruen issued a security notice on January 24, 2021 acknowledging the breach, apologizing to users, and stating that the breach had been enabled by a now-closed vulnerability that the company had identified and remediated. Gruen stated that affected users were those who had signed up for MeetMindful prior to March 2020 and that users who had created accounts or updated account details after March 2020 were not affected. The platform appears to have been substantially inactive following the breach disclosure, although Gruen did not formally announce a shutdown.