The Tokee messaging app exposed approximately 1.2 million user records due to an unsecured, internet-facing MongoDB database instance. The leak included user names, phone numbers, avatars, device tokens, and timestamps, posing significant privacy and phishing risks. While the developer, Deucetek, has since secured the database, users should remain vigilant for targeted phishing attempts.
Data Security Tokee messaging app exposes 1.2 million users’ data in MongoDB leak May 14, 2026 Share By SC Staff (Adobe Stock) The Tokee messaging app has exposed the data of approximately 1.2 million users due to an unprotected MongoDB database, according to a recent report by Tech Radar. Security researchers at Cybernews discovered that a MongoDB instance belonging to Deucetek, the developer of Tokee, was left unsecured and accessible. The exposed information includes user names, phone numbers, avatars, device tokens, user IDs, account creation and update timestamps, last seen activity, and account status. While chat logs were encrypted and not immediately at risk, the leaked personal data poses significant privacy and security concerns. Deucetek has since secured the database, and there is no evidence of malicious access or data appearing on the dark web. However, users are advised to be vigilant against potential phishing attempts, especially those impersonating Tokee or Deucetek. Source: Tech Radar SC Staff Related Data Security Veeam enhances data protection with new AI-powered features SC Staff May 13, 2026 Veeam Data Platform v13.1 introduces over 70 enhancements, including post-quantum cryptography to safeguard backups against future quantum computing threats. Data Security Instructure reaches agreement with hackers after Canvas data breach SC Staff May 13, 2026 ShinyHunters claimed responsibility for stealing more than 3.6 terabytes of data by exploiting security vulnerabilities in Instructure's Free-for-Teacher environment. Data Security Community Bank customer data exposed via unauthorized AI software SC Staff May 13, 2026 The bank, which serves customers in Pennsylvania, Ohio, and West Virginia, filed an 8-K with the U.S. Securities and Exchange Commission on May 7, detailing the incident. Related Events Cybercast Beyond the Hype: The Cybersecurity Trends CISOs are Keeping an Eye on in 2026 On-Demand Event Cybercast Beyond the data perimeter: Why next-generation DSPM is the foundation for modern data security On-Demand Event Virtual Conference Securing the Future of Finance: Strategies to Counter Modern Cyber Threats On-Demand Event Get daily email updates SC Media's daily must-read of the most current and pressing daily news Business Email By clicking the Subscribe button below, you agree to SC Media Terms of Use and Privacy Policy . Subscribe Related Terms Block Cipher Checksum Ciphertext Cryptographic Algorithm or Hash Cyclic Redundancy Check (CRC) Data Aggregation Data Encryption Standard (DES) Diffie-Hellman Digital Envelope Digital Signature You can skip this ad in 5 seconds