OrderSnapp ordersnapp.com OrderSnapp data breach: what happened and what to do
In June 2020 the restaurant ordering provider OrderSnapp suffered a breach that exposed 1.3 million email addresses, with names, phone numbers, dates of birth and bcrypt-hashed passwords. Have I Been Pwned added it in August 2021.
View all 13,115 breaches- Breach date
- 29 Jun 2020
- Affected
- 1,304,447
- Data exposed
- Dates of birth, Email addresses, Names, Passwords, Phone numbers
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
OrderSnapp provides online ordering for restaurants. Have I Been Pwned (HIBP) lists a breach dated June 29, 2020 with 1,304,447 affected accounts, added in August 2021. If you ordered food through a restaurant that used the service, your details may be in it.
What happened
HIBP says the breach exposed 1.3 million unique email addresses. The data was reported as part of a wave of leaks attributed by one security firm to the same group of hackers.
What was exposed
The data includes email addresses, names, phone numbers, dates of birth and passwords. HIBP says the passwords were stored as bcrypt hashes. A hash is a scrambled version of a password, and bcrypt is a slow, well-regarded way to make one, so strong passwords are hard to recover from it. Weak or common ones can still be guessed.
The more useful part for a scammer is the rest: a name, phone number and date of birth are enough to make a call or text sound like it comes from someone who knows you, and a date of birth is a common security question answer.
The company's response
HIBP marks the breach as verified.
What to do if you were in it
- 1
Change your password, and anywhere you reused it
Set a new password for OrderSnapp and any restaurant ordering account. If you used the same one anywhere else, change it there too, starting with email and banking. Use a password manager so every account gets its own.
- 2
Turn on two-factor authentication
Add an authenticator app or a passkey to your email, banking and shopping accounts. A leaked password alone then isn't enough to get in.
- 3
Expect calls and texts that use your details
Your phone number and date of birth are exposed. Don't confirm personal details to an unexpected caller. Hang up and call back using a number you look up yourself.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It looks across breach databases and the dark web for your email and phone number and tells you what to do about each hit.
Frequently asked
Was I affected by the OrderSnapp breach?
Search your email address on Have I Been Pwned, or run a free Serus scan to check breach databases and the dark web for your email and phone.
What was exposed?
Email addresses, names, phone numbers, dates of birth and bcrypt-hashed passwords.
Are bcrypt hashes safe?
They are much harder to crack than plain text, but weak passwords can still be guessed. Change yours if you reused it.
How many people were affected?
HIBP lists 1,304,447 accounts.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
