Summary
- Environment: Stitch community profiles and private messaging
- Operational impact: Some profile and message information accessed
- Financial impact: No incident cost established in the reviewed evidence
- Record status: Developing record. Reviewed October 20, 2026; updated as evidence emerges.
What happened
Stitch reported sustained attacks that exposed information about some members. Its sample notice confirms that information retained after account closure was included. [1]
Impact
Attackers accessed the last private message exchanged between certain members and profile fields that could include first name, photos, biography, interests, suburb, preferences and account status. [1]
Stitch said passwords, payment-card information, and account-associated email addresses and phone numbers were not accessed. Information written inside messages has a different scope. [1]
Timeline
Threat Group & Attack Vector
The notice does not establish a specific exploit or attacker identity.
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- No specific MITRE ATT&CK technique is currently mapped for this case.
Response
Stitch said it blocked the attacker, removed malicious accounts and closed the entry route. It reviewed messages automatically and alerted members whose messages might contain contact, health or financial details or a photo. The sample recipient’s messages were not found to contain those details. [1]