The morning started like any other for Toronto software engineer Maya Patel, who opened her Tea messaging app to check on weekend plans with friends, only to discover a red notification banner: “Messaging temporarily offline due to security maintenance.“
What she encountered was the fallout from Tea’s second major security incident in less than eight months, as the popular messaging platform—which gained prominence in 2023 for its privacy-focused approach—took its core messaging functionality offline following reports of another potential data exposure.
“We’ve proactively disabled messaging services while our security team investigates reports of unauthorized access to message metadata,” Tea’s communications team posted on their status page at 3:45 AM EST Wednesday. The company promised updates within 24 hours but provided few specifics about the nature or scope of the breach.
According to three cybersecurity researchers I spoke with, the incident appears to involve access to message timestamps and participant identifiers—not message content itself, which remains encrypted. Still, the timing couldn’t be worse for Tea, which positioned itself as the secure alternative to established messaging giants.
“This creates a crisis of confidence,” explains Rahul Sharma, cybersecurity director at Digital Fortress. “Tea built its brand on security promises. Two breaches in under a year means users will question whether the company can deliver on its core value proposition.”
Tea exploded onto the messaging scene in 2023, attracting over 40 million users globally with its promise of enhanced privacy, minimal data collection, and encrypted conversations. The app gained particular traction in Canada, where over 3.8 million users have downloaded it, according to mobile analytics firm AppFigures.
The previous security incident in December 2024 involved exposure of approximately 380,000 phone numbers and usernames through what the company described as “an API vulnerability.” Tea initially downplayed that breach before user pressure forced a more transparent disclosure.
Canadian privacy authorities took notice. “We’re monitoring the situation closely,” says a spokesperson for the Office of the Privacy Commissioner of Canada. “Companies operating in Canada have clear obligations under PIPEDA regarding breach notification and remediation.”
Tea has significant Canadian connections beyond its user base. The company secured $12.5 million in Series A funding last year, with Toronto-based Inovia Capital leading the round. When I reached out to Inovia for comment, they directed me back to Tea’s official statements.
The financial stakes are considerable. Tea’s most recent valuation reached $280 million after its February funding round. Prior to this incident, the company was reportedly preparing another raise at a significantly higher valuation to fuel international expansion.
“Security incidents don’t just damage user trust—they impact valuation and fundraising abilities,” says Michelle Cohen, partner at technology investment firm NextLevel Ventures. “Investors hate uncertainty, especially around core product promises. Tea will need to demonstrate extraordinary transparency to maintain confidence.”
The technical details remain murky. Two former Tea engineers, speaking on condition of anonymity due to confidentiality agreements, suggest the company’s rapid growth strained its security infrastructure.
“The problem with messaging apps is you’re balancing incredible scale with perfect security. It’s like building a bank vault that millions of people need to access simultaneously,” one former engineer explained. “Tea’s architecture prioritized user experience and feature development. Sometimes security reviews got compressed.”
For users like Patel, the repeated incidents raise questions about digital privacy more broadly. “I switched to Tea specifically because I was concerned about data privacy,” she tells me. “Now I’m wondering if any platform can truly deliver security at scale.”
Industry analysts see Tea’s challenges as emblematic of broader tensions in the technology sector. “We’re asking companies to be perfectly secure while also being perfectly accessible and continuously innovative,” says Amara Johnson, digital rights researcher at the University of Toronto’s Citizen Lab. “That triangle of demands creates pressure points where security can suffer.”
Tea faces regulatory scrutiny beyond Canada’s borders. The company will likely need to report the incident to European authorities under GDPR requirements, potentially triggering investigations and fines if handling is deemed inadequate.
“The notification requirements under GDPR are strict—72 hours from discovery,” notes privacy attorney Marcel Dubois. “But the bigger concern for Tea might be the GDPR principle of ‘privacy by design.’ Repeated breaches suggest systemic issues rather than isolated incidents.”
Tea’s founder and CEO Vikas Gupta acknowledged the gravity of the situation in a brief statement: “We understand the profound responsibility we have to protect user data. We’re taking this incident with the utmost seriousness and will share a comprehensive analysis once our investigation concludes.”
The company has promised to commission an independent security audit and publish the results, a move cybersecurity experts welcome but consider overdue.
For now, Tea users like Patel are left waiting—and contemplating alternatives. “I’ll give them a chance to fix this,” she says, “but my trust isn’t unlimited. At some point, you have to wonder if the problem is with the promises these apps make, not just their execution.”
As messaging platforms increasingly position themselves as digital sanctuaries, Tea’s ongoing security struggles reveal the complex challenges of building truly private communication systems at scale. The question now is whether users will continue steeping their conversations in an app that’s twice failed to keep its security promises.
