It sounds like these were actual vulnerabilities (details not yet disclosed) as opposed to a publicly exposed DB. But also...
an email address and plaintext password belonging to the app’s creator, Lampkin, was left exposed on the server. The credentials appear to grant access to the app’s “admin” panel.
If their excuse was "they stole the admin password" then I'm with evilplushie, this may have been a honeypot that always intended to leak the users private info.
Because that is way too convenient for people who wanted to even the score after the first tea leak.
It sounds like these were actual vulnerabilities (details not yet disclosed) as opposed to a publicly exposed DB. But also...
Arguably worse than a simple data leak.
If their excuse was "they stole the admin password" then I'm with evilplushie, this may have been a honeypot that always intended to leak the users private info.
Because that is way too convenient for people who wanted to even the score after the first tea leak.