FlexBooker flexbooker.com FlexBooker data breach: what happened and what to do
In December 2021, booking service FlexBooker suffered a breach that exposed about 3.7 million accounts. Email addresses, names and phone numbers were included. HIBP added it on 6 January 2022.
View all 13,115 breaches- Breach date
- 23 Dec 2021
- Affected
- 3,756,794
- Data exposed
- Email addresses, Names, Partial credit card data, Passwords, Phone numbers
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
FlexBooker, an online booking service, was breached in December 2021. Have I Been Pwned (HIBP) lists 3,756,794 affected accounts.
What happened
FlexBooker said its Amazon Web Services (AWS) account was compromised on 23 December 2021, which disrupted the service and let someone access and download stored data. HIBP says the breach came from a compromised account in FlexBooker's AWS infrastructure. According to reporting from Infosecurity Magazine and BleepingComputer, FlexBooker restored a backup and resumed service within about 12 hours, and posted its notice in the first week of January 2022.
HIBP added the data on 6 January 2022.
What was exposed
The data includes email addresses, names and phone numbers. HIBP also lists partial credit card data and password hashes for a small number of accounts, although FlexBooker said full payment card details were not taken. FlexBooker said passwords were encrypted and the key wasn't accessed.
Businesses that use FlexBooker were affected too. Bunnings in Australia told customers that name and email addresses given when booking a Drive & Collect slot may have been exposed.
With your name, email and phone number, criminals can send phishing emails and text messages that mention an appointment or booking.
The company's response
FlexBooker published a notice and advised customers to review their accounts for suspicious activity and check their credit reports.
What to do if you were in it
- 1
Expect booking and appointment scams
Be wary of emails or texts about a booking, a deposit or a changed appointment, especially if they include a link. Contact the business directly using details you already have.
- 2
Change your password and turn on 2FA
If you used the same password anywhere else, change it there too, and use two-factor authentication on important accounts.
- 3
Watch for smishing
Your phone number was exposed. Don't tap links in unexpected text messages, and don't share one-time codes with anyone who contacts you.
- 4
Review your card statements
HIBP lists partial card data for some accounts. Check your statements and report charges you don't recognize to your bank.
- 5
Run a free breach check
Check whether your email or phone number shows up in this and other breaches with a free Serus scan.
Frequently asked
Was I affected by the FlexBooker breach?
If you booked through a business that uses FlexBooker around December 2021, possibly. HIBP lets you search your email address, and a free Serus scan checks it against this and other breaches.
What was exposed in the FlexBooker breach?
Email addresses, names and phone numbers. HIBP also lists partial credit card data and password hashes for a small number of accounts.
Should I change my password?
Yes, if you reused it anywhere. Use a unique password and turn on two-factor authentication.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
