ixigo ixigo.com ixigo data breach: what happened and what to do
In January 2019, travel booking site ixigo was breached. Over 17 million email addresses leaked with names, genders, phone numbers, Facebook profile links and MD5 password hashes, then appeared for sale in February 2019.
View all 13,115 breaches- Breach date
- 3 Jan 2019
- Affected
- 17,204,697
- Data exposed
- Auth tokens, Device information, Email addresses, Genders, Names, Passwords, Phone numbers, Salutations, Social media profiles, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In January 2019, the travel and hotel booking site ixigo suffered a data breach. According to Have I Been Pwned, the data appeared for sale on a dark web marketplace the following month.
What was exposed
The data covers about 17.2 million unique email addresses. It also includes names, genders, phone numbers and usernames. Links to Facebook profiles, device details and auth tokens are in there too. Passwords were stored as MD5 hashes, an old and weak method that is quick to crack.
What it means for you
Phone numbers make text scams (smishing) easy. A travel app hands scammers their story: a cancelled booking, a refund. MD5 hashes crack fast. Treat the old password as known. Auth tokens are meant to keep you logged in, so log out of the app and sign in again.
Can the data be taken down?
No. Once a breach is copied and shared, nobody can pull it back, and the company can't either. What you control is how useful the data is to criminals: unique passwords, two-factor login and skepticism toward messages that quote your details. Serus monitors breach databases and the dark web for your email and phone and alerts you when your details appear in a new leak.
What to do
Change reused passwords and turn on two-factor login. Check any booking message by opening the app yourself.
What to do if you were in it
- 1
Change your ixigo password, and any you reused
If you used the same or a similar password on another account, change it there too. A password manager makes unique passwords easy.
- 2
Turn on two-factor login
Use an authenticator app or a passkey on your email and other important accounts. It blocks most takeovers even when a password is already out.
- 3
Expect phishing that fits the data
Expect texts and emails about bookings, refunds or cancellations. Open the app or site yourself instead of tapping links.
- 4
Check which other breaches include you
Run a free Serus scan to see whether your email or phone number appears in this and other breaches. Serus monitors breach databases and the dark web and alerts you when your details show up again.
Frequently asked
Was I affected by the ixigo breach?
Check your email on Have I Been Pwned or run a free Serus scan. If you had an ixigo account in early 2019, assume yes.
What was exposed?
Email addresses, names, genders, phone numbers, usernames, Facebook profile connections, device information, auth tokens and MD5 password hashes.
Should I change my password?
Yes. MD5 hashes are weak, so assume the password is known, and change it anywhere you reused it.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
