Yatra data breach: what leaked and what to do
Yatra (yatra.com) had a data breach on 2013-09-01 affecting 5,033,997 accounts. Passwords were involved.
!Passwords leaked
Added to the catalogue 5 July 2018.
What leaked
- Dates of birth
- Email addresses
- Names
- Passwords
- Phone numbers
- Physical addresses
- PINs
What happened
In September 2013, the Indian bookings website known as Yatra had 5 million records exposed in a data breach. The data contained email and physical addresses, dates of birth and phone numbers along with both PINs and passwords stored in plain text. The site was previously reported as compromised on the Vigilante.pw breached database directory.
Description from Have I Been Pwned, in its words.
What to do
- Change the password on that service, and anywhere you used the same password. A password manager makes this painless.
- Turn on two-factor sign-in on that service and on your email.
- Warn staff: emails, texts or calls quoting leaked details are not proof the sender is genuine.
- If card or bank details leaked, watch statements and tell the bank; if identity documents leaked, consider a credit ban or alert.
Common questions
What leaked in the Yatra breach?
Dates of birth, Email addresses, Names, Passwords, Phone numbers, Physical addresses, PINs
When did the Yatra breach happen?
The breach date is 2013-09-01; it was added to the public catalogue on 2018-07-04.
What should I do if my staff used this service?
Change the password there and anywhere it was reused, turn on two-factor sign-in, and warn staff about emails quoting the leaked details.
Was a staff address in this breach?
Check one address free, no storage. Breach Watch checks every staff address after each new breach.