Ladies.com, a niche lesbian dating platform, suffered a data breach due to an exposed Firebase database that had been left publicly accessible without proper authentication or access-control configuration since approximately February 2024 or earlier. The vulnerability was independently identified by security researcher 'BobDaHacker' who reported it to the platform operator beginning February 25, 2024, but the operator did not remediate the vulnerability for approximately nine and a half months despite the disclosure attempts. OSINT researcher Ryan Fae publicly disclosed the vulnerability on X on December 3, 2024 with details indicating the scope of the exposure across Ladies.com and the operator's sister platform Senior Dating, which prompted the operator to acknowledge the breach and shut down both platforms on approximately December 4, 2024. The breach was indexed by Have I Been Pwned on December 9, 2024.

The breach affected approximately 118,800 users on Ladies.com based on records indexed by breach-tracking services, alongside approximately 765,517 users on Senior Dating for a combined disclosure of approximately 917,000 users across the operator's two platforms. Compromised fields included email addresses, full names, usernames, dates of birth, profile photographs and additional photographs, biographical information, geographic location data with precise latitude and longitude coordinates, sexual orientation, gender, education levels, family structure, relationship statuses, drinking and smoking habits, and tattoo status. The dataset did not include passwords because Firebase authentication is typically managed through linked authentication providers including Facebook rather than through stored credentials. The combination of profile photograph with precise geographic coordinates, sexual orientation, and demographic information creates an exceptionally severe identification and outing risk because affected users can be visually and contextually matched across multiple data points to specific addresses or neighborhoods, with sexual orientation as an explicitly disclosed field rather than an inferred attribute.

For affected users, the practical risk profile is exceptionally severe given the LGBTQ+-specific sensitivity of the field set and the precision of the geographic data. The combination of profile photograph with precise GPS coordinates and explicit sexual orientation disclosure creates targeted outing, harassment, blackmail, and physical-safety risk that may be particularly severe for users in family, employment, or jurisdictional environments hostile to LGBTQ+ identity, including users in U.S. states or other jurisdictions with limited LGBTQ+ legal protections, users in religious or family communities where outing carries significant consequences, and users whose employment status could be affected by outing. Affected users who receive extortion or outing-threat attempts should not pay ransom demands because payment does not stop further extortion. Users should document any threatening communications, treat all unsolicited contact referencing Ladies.com or related platforms with extreme caution, and report extortion attempts to local law enforcement. LGBTQ+ users with personal-safety concerns may benefit from contacting LGBTQ+ advocacy organizations including the Trevor Project (1-866-488-7386) and GLAAD's safety resources for confidential support. Affected users in violent-relationship situations may also benefit from contacting the U.S. National Domestic Violence Hotline (1-800-799-7233).

Dating platforms collect highly sensitive profile data, photos, messages, subscription records, and relationship-intent information tied to matchmaking and social interaction.

Ladies.com was shut down on approximately December 4, 2024 following the public disclosure of the Firebase database exposure, and the website is no longer operational. The shutdown also covered Senior Dating, the sister property operated by the same entity. Independent researcher 'BobDaHacker' attempted to disclose the Firebase vulnerability to the operator beginning February 25, 2024, approximately nine months before the public disclosure forced operator action. The case has been widely cited in LGBTQ+-platform cybersecurity coverage as illustrating the elevated risk profile of LGBTQ+ dating-platform exposure and the consequences of operator unresponsiveness to security disclosure. The breach was indexed by Have I Been Pwned on December 9, 2024.