Tea, a women’s safety dating app that has surged to the top of the free iOS App Store listings, suffered a major security breach last week. The company confirmed Friday that it has “identified authorized access to one of our systems” that exposed thousands of user images. And now, there’s the potential that more details on people using the app could be accessed.

According to Tea’s preliminary findings from the end of last week, the breach allowed access to approximately 72,000 images, broken down into two groups: 13,000 images of selfies and photo identification that people had submitted during account verification and 59,000 images that were publicly viewable in the app from posts, comments and direct messages.

Those images had been in a “legacy data system” that contained information from more than two years ago, the company said in statement. “At this time, there is no evidence to suggest that current or additional user data was affected.”

Earlier Friday, posts on Reddit and 404 Media reported that Tea app users’ faces and IDs had been posted on anonymous online message board 4chan.

Tea requires users to verify their identities with selfies or IDs, which is why driver’s licenses and pictures of people’s faces are in the leaked data.

Tea said it has launched a full investigation to assess the scope and impact of the breach.

DMs potentially exposed

A security researcher has also discovered that it is possible for hackers to gain access to DMs between Tea users, according to a report by 404 Media on Monday. This reportedly affects messages sent up to last week by people using the Tea app. Tea didn’t immediately respond to a request for comment on this latest report.

The premise of Tea is to provide women with a space to report negative interactions they’ve had while encountering men in the dating pool, purportedly to keep other women safe. The app hit the No. 1 spot on Apple’s US App Store last week, drawing international attention and sparking a debate about whether the app violates men’s privacy. If the reports of a breach turn out to be true, it will also play into the wider ongoing debate around whether online identity and age verification pose an inherent security risk to internet users.

In the privacy section on its website, Tea says: “Tea Dating Advice takes reasonable security measures to protect your Personal Information to prevent loss, misuse, unauthorized access, disclosure, alteration and destruction. Please be aware, however, that despite our efforts, no security measures are impenetrable.”