Stitch data breach: hackers reached private messages and profiles of 113,727 members of the over-50 community

What happened in the Stitch hack?

Stitch's notice email, as filed with California's attorney general, says the company had been the target of "a sustained and sophisticated series of hacking attacks over the last week", and that over a weekend the hackers were able to access information about what it calls a small percentage of members. The email does not say how the attackers got in. It says Stitch blocked the attacker, removed the malicious accounts the attacker had created, and closed the route that was used.

Date (2026)	What happened	Source
The week before the notice	A series of hacking attacks on Stitch	Notice email
September 14	Breach date in Indiana's record	Indiana report
September 18	Breach date in California's record	California list
September 21	Notice sent, per Indiana's record	Indiana report
October 18	Notice recorded by California	California list

California's list gives a breach date of September 18, 2026 and a reported date of October 18, 2026, four days apart from Indiana's breach date. The two records come from the same company; neither explains the gap.

Were Stitch members' private messages exposed?

Some were. The email says the hacker reached the last private message sent between certain members, and that Stitch's systems detected that some members' final messages were accessed. Stitch says it ran an automatic review of those messages for sensitive content and alerted members who may have shared contact details, health information, financial details or a photo in them. The sample email filed with California is addressed to a member whose messages were not found to hold any of those details; members whose messages were flagged were alerted separately.

What profile information was accessed?

The email lists first name, profile photos, bio, interests, suburb location, preferences and account status. Stitch's own warning is that this sort of detail can make a scam email, text or phone call look more convincing, and it asks members to treat unexpected contact with suspicion. For a community whose members are all over 50 and are there to meet new people, that warning is the practical point of the notice.

Were passwords or card details taken?

Stitch says no. The email says twice that no passwords were taken and no credit card information was accessed, and it tells the member it is addressed to that the attackers did not get into their account or the password, email address or phone number tied to it. It also explains why some former members were told: rules in most countries require Stitch to keep some information for a while after an account is deleted, so closed accounts were in scope too.

What should Stitch members do?

The sample notice offers no credit monitoring, and it lists no Social Security numbers, card numbers or passwords among the data reached. What it asks for is caution. In practice that means treating any call, text or email that mentions a Stitch conversation, a photo or a suburb as possibly coming from someone who read the stolen data, and not sending money or personal details to a contact met through the site without checking who they are. The social engineering guide shows how attackers use details like these against companies; the same approach works against people.

How many Texans were affected by the Stitch hack?

Texas's attorney general lists a report from Stitch Connect Inc, posted on October 16, 2026, with 4,062 Texans affected. The Texas record lists names, medical information and dates of birth among the information involved. Medical information and dates of birth are not in the email's own list of profile details, and the records do not explain the difference. The Texas ranking lists 2026's largest reports. The figure counts Texans only.

What the record leaves open

• How the attackers got in, and whether they demanded anything.
• How many of the 113,727 had messages flagged for sensitive content.
• Which countries the affected members live in; Stitch runs groups in cities around the world.
• Why Indiana and California record different breach dates.