Eatigo eatigo.com Eatigo data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Eatigo's customer database was breached in October 2018, exposing 2.8 million accounts: email addresses, names, phone numbers, genders, social media profiles and passwords stored as unsalted MD5 hashes. It was added to Have I Been Pwned in August 2021.
View all 13,118 breaches- Breach date
- 16 Oct 2018
- Affected
- 2,789,609
- Data exposed
- Email addresses, Genders, Names, Passwords, Phone numbers, Social media profiles
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Eatigo is a restaurant reservation service. According to Have I Been Pwned, its customer database was breached in October 2018, exposing about 2.8 million accounts. The data was added to Have I Been Pwned in August 2021.
Eatigo told customers on 31 October 2020 that it had learned of unauthorised access to its customer database that potentially affected 2.8 million accounts. The company said the data was more than 18 months old and included names, email addresses and phone numbers, and that existing account passwords were encrypted. It still urged customers to reset their passwords as a precaution. Reports at the time said the data was being offered for sale online.
Sources checked: haveibeenpwned.com, channelnewsasia.com, databreaches.net
Last verified against the official page:
What was exposed
Have I Been Pwned lists email addresses, names, phone numbers, genders, social media profiles and passwords. The passwords were stored as unsalted MD5 hashes, a weak method that makes many passwords quick to crack.
What it means for you
A name, email address and phone number together are enough for convincing phishing and text scams that mention restaurant bookings or your Eatigo account. If you used your Eatigo password anywhere else, criminals can try it on those accounts, because hashes this weak are easy to crack.
What to do if you were in it
- 1
Change your password, and any reuse of it
Change your Eatigo password, then change it on every other account where you used the same or a similar one. Use a password manager so each account gets a unique password, and turn on two-factor login where it's offered.
- 2
Expect phishing that mentions the breach
Scammers use leaked email addresses and phone numberses to send convincing messages. Don't click links in unexpected emails or texts about your account, and go to the site directly instead.
- 3
Treat unexpected texts and calls with suspicion
Your phone number was in the data. If someone calls or texts claiming to be from a restaurant, a delivery service or your bank, hang up and contact the company using a number from its official site.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches include your email address or phone number. Serus keeps monitoring breach databases and the dark web and alerts you when your details show up in a new leak. It can't remove data that has already leaked.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by the Eatigo breach?
If you had an Eatigo account around 2018, your details may be among the 2.8 million accounts. You can check your email address on Have I Been Pwned or run a free Serus scan.
What was exposed in the Eatigo breach?
Email addresses, names, phone numbers, genders, social media profiles and passwords stored as unsalted MD5 hashes.
Should I change my password?
Yes. Eatigo itself urged customers to reset passwords as a precaution, and you should change it anywhere you reused it.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
