SAN FRANCISCO, United States (AFP) — An American app that lets women share “red flags” or feedback about men they have dated called “Tea” confirmed Friday that hackers had accessed some 72,000 images including user identification (ID).

A preliminary investigation indicated hackers early Friday accessed a “legacy” storage system holding images uploaded by users who signed up before February of last year, a Tea spokeswoman told AFP.

Stolen pictures included some 13,000 selfies or images featuring photo identification submitted to verify Tea accounts, according to the spokeswoman.

The rest of the pictures were from posts, comments or messages publicly viewable in the app, the company said.

No email address or phone number data was accessed, according to Tea.

Tea’s website boasts a “sisterhood” of more than 1.6 million women who can share dating advice and experiences anonymously on the platform.

The app has attracted interest and triggered controversy with its promise to help women avoid problematic men and get intel on dating prospects.

Critics point out privacy risks of date reviews that include photos and names, while fans tout the potential for women to avoid manipulative, dishonest or violent encounters.

Tea became the top free app in the lifestyle category in Apple’s App Store this week after it went viral on social media.

Copies of ID card photos swiped from Tea were posted Friday on 4Chan, an online forum known for “incel” culture and rampant misinformation, according to screenshots shared on Reddit and other sites.

The security breach, involving images of IDs like driver licenses, exposes victims to the risk of stalking or identity theft, according to Trey Ford, head of security at cybersecurity company Bugcrowd.

“Connecting usernames to actual legal names and home addresses exposes these women to a variety of concerns,” Ford told AFP.

“Identity theft is only the tip of this iceberg.”