RentoMojo rentomojo.com RentoMojo data breach: what happened and what to do
In April 2023 the Indian rental service RentoMojo suffered a data breach. Have I Been Pwned lists 2,185,697 accounts, with names, emails, phone, passport and Aadhaar numbers, dates of birth, purchases and bcrypt password hashes exposed.
View all 13,115 breaches- Breach date
- 15 Apr 2023
- Affected
- 2,185,697
- Data exposed
- Dates of birth, Email addresses, Genders, Government issued IDs, Names, Passport numbers, Passwords, Phone numbers, Purchases, Social media profiles
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
RentoMojo rents out furniture and appliances in India. In April 2023 customer data from the company was exposed in a breach that Have I Been Pwned (HIBP) dates to 15 April 2023 and added to its database on 10 May 2023.
What happened
RentoMojo emailed customers on 20 April 2023 to say someone had gained unauthorized access to one of its databases, and said no card, debit card or UPI details were affected, according to YourStory. India Today reported that the company confirmed identifiable customer information was accessed. The company's own figure for affected subscribers was far lower than the one HIBP recorded, so treat the 2.2 million email addresses as the best public count of records, not necessarily of customers.
What was exposed
HIBP lists 2,185,697 accounts with dates of birth, email addresses, genders, government issued IDs, names, passport numbers, passwords (stored as bcrypt hashes), phone numbers, purchases and social media profiles.
That mix is more serious than a typical email leak. A name, date of birth and ID number together are what someone needs to impersonate you with a lender or a mobile carrier. Phone numbers and purchase history make phishing calls sound legitimate: a caller who knows what you rented and when is easy to believe. The password hashes are hard to crack when they are bcrypt, but weak passwords can still fall.
What to do
Change your RentoMojo password and any account that shares it. If you gave an ID or passport number, watch for new accounts or SIM changes in your name and tell your bank if anything looks off. Expect calls and messages that mention RentoMojo.
What to do if you were in it
- 1
Change your password and any reuse of it
Change it on the affected service and on every other account that uses the same or a similar password. A password manager makes unique passwords easy. Turn on two-factor login where it's offered.
- 2
Freeze your credit if identity documents leaked
Place a free credit freeze at Equifax, Experian and TransUnion if a government ID or passport number was exposed, then watch your statements and credit reports for accounts you don't recognize.
- 3
Expect phishing that mentions the breach
Treat unexpected emails, texts and calls as suspect, especially ones that name the company or offer help with the breach. Don't click links in them; go to the company's site yourself.
- 4
Check which other breaches include you
Run a free Serus scan to see whether your email or phone number appears in this and other breaches. Serus monitors breach databases and the dark web and alerts you when your details show up in a new leak.
Frequently asked
Was I affected by the RentoMojo breach?
Look up your email on Have I Been Pwned, or run a free Serus scan. HIBP lists 2,185,697 accounts from this breach.
What was exposed?
Names, email addresses, phone numbers, genders, dates of birth, passport and government ID numbers, purchases, social media profiles and bcrypt password hashes.
Should I change my password?
Yes. Change it on RentoMojo and on any other account where you used the same or a similar one, and turn on two-factor login.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
