EatStreet eatstreet.com EatStreet data breach: what happened and what to do
In May 2019 the food ordering service EatStreet was breached. Have I Been Pwned lists about 6.4 million accounts, with names, phone numbers, addresses, birth dates, partial card data and bcrypt password hashes exposed.
View all 13,115 breaches- Breach date
- 3 May 2019
- Affected
- 6,353,564
- Data exposed
- Dates of birth, Email addresses, Genders, Names, Partial credit card data, Passwords, Phone numbers, Physical addresses, Social media profiles
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
In May 2019, the online food ordering service EatStreet suffered a data breach. The company disclosed it in June 2019. Have I Been Pwned (HIBP) added it on July 19, 2019 and lists it as verified.
What happened
According to news coverage, an unauthorized party got into EatStreet's systems on May 3, 2019, and the company found and shut the access on May 17. EatStreet notified diners, delivery partners and restaurants. The company described the group affected as a limited number of diners. HIBP puts the breach at 6.4 million customers.
What was exposed
HIBP counts 6,353,564 accounts, and lists dates of birth, email addresses, genders, names, partial credit card data, passwords, phone numbers, physical addresses and social media profiles. Passwords were stored as bcrypt hashes, a strong format that is slow to crack, so a long unique password is unlikely to be recovered.
News reports on the notices also say that for a limited number of diners the exposed data may have included card details such as expiration date and billing address, and that restaurant partners' bank account and routing numbers may have been involved.
What that lets criminals do
A name, phone number and home address together are what scammers need for convincing texts and calls, such as a fake delivery problem or refund. Dates of birth help identity thieves match this data with other breaches. If card details were involved, watch statements for charges you don't recognize.
What to do now
Change your EatStreet password and any reuse of it. Check card statements, and ask your bank for a new card if you think yours was involved. Be careful with texts and calls about food orders you didn't place.
What to do if you were in it
- 1
Change your EatStreet password, and every reuse of it
Passwords were bcrypt hashes, which are hard to crack, but change it anyway if you reused it anywhere.
- 2
Check card statements
Look for charges you don't recognize. If you think your card was involved, ask your bank for a new number.
- 3
Expect delivery and refund scams
Don't click links in texts or emails about orders or refunds you didn't expect. Open the app or site yourself.
- 4
Turn on two-factor login
Use an authenticator app or passkey on your email and other key accounts.
- 5
See which other breaches include you
Run a free Serus scan to see which other breaches include your email or phone.
Frequently asked
Was I affected by the EatStreet breach?
If you ordered through EatStreet before mid-2019, possibly. Check your email on Have I Been Pwned or run a free Serus scan. HIBP lists 6,353,564 accounts.
What was exposed in the EatStreet breach?
Dates of birth, email addresses, genders, names, partial card data, bcrypt password hashes, phone numbers, addresses and social media profiles.
Were credit cards exposed?
HIBP lists partial credit card data. News coverage of the notices says full card details may have been involved for a limited number of diners.
Should I change my password?
Yes, and anywhere you reused it.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
