Stitch data breach: what members should do now

What happened

In an email to members, Stitch said it had been the target of a sustained series of hacking attacks over about a week, and that over a weekend the attackers were able to access information about a small percentage of members. Its filing with the California Attorney General lists the breach date as September 18, 2026.

Stitch says it blocked the attacker, removed the fake accounts the attacker created, and closed the route they used to get in. It says the attackers did not get into members' accounts, passwords, email addresses, or phone numbers.

Some people whose accounts were already closed were also affected. Stitch's email explains that it keeps certain information for a period after an account is deleted.

Stitch hasn't published a total. Its filing with the Texas Attorney General lists 4,062 Texans affected, and it notified attorneys general in several other states.

What information was exposed

• First name, profile photos, bio, interests, and preferences
• General location (suburb or area, not a street address)
• Account status
• For some members, the most recent private messages with other members

Stitch says it scanned the exposed messages and separately alerted members whose messages may have contained contact details, health information, financial details, or a photo. Its Texas filing lists medical information among the types of data involved, which likely reflects what some members shared in messages. Stitch says passwords and credit card information were not taken.

What to do now

1. Read your email from Stitch carefully. It says whether your messages were among those accessed, and whether they contained sensitive details.
2. Be suspicious of unexpected contact. A scammer may mention Stitch, a conversation you had, your hobbies, or your area to seem familiar. Contact people only through ways you already know are real.
3. Watch for romance and friendship scams. Warning signs include someone who moves quickly to private apps, can't meet in person or on video, or asks for money, gift cards, cryptocurrency, or help with an "emergency." Never send money to someone you've only met online.
4. If you shared your phone number, address, health, or financial details in a Stitch message, assume a stranger may have seen them. Watch your accounts, and be extra careful with calls that mention your health or finances.
5. Report scam attempts to the FTC at ReportFraud.ftc.gov. If you've lost money, contact your bank right away.
6. Talk with friends and family who use Stitch or similar sites. Scams that target people over 50 work best when nobody else knows they're happening.

Ask Stitch to delete your data

The fewer places your information sits, the less there is to steal. To delete your account, open the top menu, choose More > Profile & Settings > Account Information, scroll to Deactivation & Deletion, choose delete, and confirm. Deactivating only hides your profile; deleting removes it. Stitch's own email notes that it keeps some information for a period after deletion to meet legal requirements.

Your legal right to deletion

If you live in a state with a consumer privacy law, such as California, Colorado, Connecticut, Maryland, Minnesota, or Oregon, covered companies generally have to honor your deletion request within the deadline your state sets, except for information they're legally required to keep. See what your state's law requires.

Sources: California Attorney General breach notice and Stitch's member email, ClaimDepot summary of state filings, and Stitch Help. DataTrail isn't affiliated with Stitch. This page is general information, not legal advice.