Zomato zomato.com Zomato data breach: what happened and what to do
In May 2017 the restaurant guide Zomato was hacked and almost 17 million accounts were exposed: email addresses, usernames and salted MD5 password hashes. Zomato said payment details are stored separately and were not affected.
View all 13,115 breaches- Breach date
- 17 May 2017
- Affected
- 16,472,873
- Data exposed
- Email addresses, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In May 2017, the restaurant guide and food delivery site Zomato confirmed it had been hacked. Have I Been Pwned (HIBP) lists 16,472,873 accounts. News outlets reported that a seller on a dark web marketplace was offering the user database for sale, and that sample records checked out as real Zomato accounts.
Zomato said the incident looked like an internal security breach, with a development account compromised. It also said payment information is kept in a separate vault that meets the PCI DSS card industry standard, so card details were not part of the leak. The company said it contacted the seller and had the data taken down from the marketplace, but copies had already spread. HIBP later received the data from a security researcher.
What was exposed
HIBP lists email addresses, usernames and password hashes. The hashes were salted MD5, and they were missing for some accounts. MD5 is an old method that is quick to test guesses against, so weak passwords can be recovered.
Your email address and username let scammers send messages that look like Zomato offers or account alerts. If you reused your Zomato password, attackers can try it on your email and other accounts.
What to do
Check whether your email is in the data, change any password tied to Zomato and use a unique one everywhere.
What to do if you were in it
- 1
Change your Zomato password and any reuse of it
If you still have a Zomato account, set a new password. Then change it on every other account that shares the old one or a close variation. A password manager makes unique passwords painless.
- 2
Turn on two-factor login
Use an authenticator app on your email, banking and shopping accounts. A leaked password then isn't enough to get in.
- 3
Expect phishing that mentions the breach
Scammers use leaked email addresses to send fake security alerts. Don't click links in unexpected messages. Go to the site yourself instead.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches include your details. Serus monitors breach databases and the dark web and alerts you, but it can't remove data from a breach.
Frequently asked
Was I affected by the Zomato breach?
If you had a Zomato account in May 2017, your email, username and password hash may be in the data. Look up your email on Have I Been Pwned or run a free Serus scan.
What was exposed in the Zomato breach?
HIBP lists email addresses, usernames and salted MD5 password hashes, which were missing on some accounts. Zomato said payment details were stored separately.
Were my card details exposed?
Zomato said payment information is kept in a separate PCI DSS compliant vault and was not part of the breach. HIBP lists no payment data for it.
Should I change my password?
Yes, especially if you reused it. Change it on Zomato and everywhere else it was used.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
