Zomato data breach: what leaked and what to do
Zomato (zomato.com) had a data breach on 2017-05-17 affecting 16,472,873 accounts. Passwords were involved.
!Passwords leaked
Added to the catalogue 5 Sept 2017.
What leaked
- Email addresses
- Passwords
- Usernames
What happened
In May 2017, the restaurant guide website Zomato was hacked resulting in the exposure of almost 17 million accounts. The data was consequently redistributed online and contains email addresses, usernames and salted MD5 hashes of passwords (the password hash was not present on all accounts). This data was provided to HIBP by whitehat security researcher and data analyst Adam Davies.
Description from Have I Been Pwned, in its words.
What to do
- Change the password on that service, and anywhere you used the same password. A password manager makes this painless.
- Turn on two-factor sign-in on that service and on your email.
- Warn staff: emails, texts or calls quoting leaked details are not proof the sender is genuine.
- If card or bank details leaked, watch statements and tell the bank; if identity documents leaked, consider a credit ban or alert.
Common questions
What leaked in the Zomato breach?
Email addresses, Passwords, Usernames
When did the Zomato breach happen?
The breach date is 2017-05-17; it was added to the public catalogue on 2017-09-04.
What should I do if my staff used this service?
Change the password there and anywhere it was reused, turn on two-factor sign-in, and warn staff about emails quoting the leaked details.
Was a staff address in this breach?
Check one address free, no storage. Breach Watch checks every staff address after each new breach.