AI girlfriend data breaches: what leaked, when, and how to protect yourself

Timeline of AI companion leaks

Chat & Ask AI is a general chatbot, not a companion app, but it shows the same failure: a database left open to anyone who found it.

What these leaks had in common

The data was deeply personal. Prompts and chats reveal fantasies, relationships and mental health. In the Muah.AI case, 404 Media reported that prompts were linked to email addresses, many containing real names.

It was tied to identity. Emails, device IDs and IP addresses turn embarrassing text into something that can be traced to a person. Help Net Security reported that nearly 70,000 of the prompts in the My Lovely AI leak were linked to user IDs, and warned of sextortion risk.

It was stored carelessly. The Chattee and GiMe data sat in an unprotected server, the Secret Desires files in open cloud storage and the Chat & Ask AI messages in a misconfigured Firebase database. The hacker behind the Muah.AI breach described the site as "basically a handful of open-source projects duct-taped together".

A wider problem: the 2026 security audit

In March 2026, security firm Oversecured published an audit of 17 AI companion and AI girlfriend apps used by more than 150 million people. It found 14 critical and 311 high-severity issues, and 10 of the 17 apps had routes to stored conversations. One app shipped its OpenAI token and a Google Cloud private key inside its code.

Privacy researchers had warned earlier. Mozilla's 2024 review of 11 romantic chatbots found that 10 failed its minimum security standards, and Gizmodo's report on the review noted that 90% may sell or share user data.

Regulators act too. Italy's data protection authority fined Replika's developer, Luka Inc., 5 million euros in 2025 for GDPR failures, including no age verification until February 2023.

Breached apps in our rankings

My Lovely AI is one of the 31 apps in our rankings, so we note the breach here and on its page. Have I Been Pwned lists the April 2026 incident as affecting 106,300 accounts, with user-created prompts and links to generated images exposed. Our My Lovely AI review covers the app, and its trust score reflects our published criteria in our methodology.

Muah.AI, breached in 2024, is also in our data; see our Muah AI review. A breach does not mean every other app is safe. Most apps never face an independent security test, so a clean record may only mean nobody has looked yet.

How to check if you were affected

1. Search your email on Have I Been Pwned. It lists the Muah.AI and My Lovely AI breaches, among thousands of others.
2. Change your password on the app and anywhere else you used the same one.
3. Watch for extortion emails. Scammers use leaked data to threaten exposure. Do not pay and do not reply; report it.
4. Delete your account if you no longer use the app, so there is less to leak next time.

If someone threatens to expose you, our guide to AI girlfriend scams covers how extortion works and where to report it.

How to limit the damage next time

• Sign up with an email you use for nothing else, with no real name in it.
• Never upload photos of yourself or of real people you know.
• Keep identifying details out of chats and prompts.
• Prefer apps that name their company and let you delete your account and data.
• Delete old chats and accounts you no longer use.

Our guides to whether AI girlfriend apps read your chats and how to delete your account go further.