Eatigo Data Breach (2018): What Was Exposed & What To Do

What happened

The breach involved the exposure of 2.8 million user accounts from Eatigo. Public reporting on the incident began on October 16, 2018. The data set contained email addresses, names, phone numbers, social media profiles, genders and passwords stored as unsalted MD5 hashes. No further details on the method of access, exact timing of the intrusion or subsequent actions by the organization have been disclosed in available records.

How a breach like this happens

Incidents involving the exposure of user account data often stem from unauthorized access to databases that store customer records. Attackers may exploit vulnerabilities in web applications, compromised credentials or misconfigured storage systems to retrieve large volumes of information. Once obtained, such data sets are sometimes posted or traded online. The use of unsalted MD5 hashes for passwords, as noted in this case, reflects an older hashing approach that does not incorporate additional protective measures now considered standard.

Eatigo and its sector

Eatigo operates as a restaurant reservation platform, connecting users with dining options across multiple markets. Services of this type maintain accounts that include contact details and booking preferences to facilitate reservations. A breach at such a company can affect individuals who have used the platform for personal or professional dining arrangements, and the sector routinely processes information that links online identities with real-world contact methods.

What data was at risk

The records reported as exposed included email addresses, names, phone numbers, social media profiles, genders and passwords stored as unsalted MD5 hashes. These categories align with the types of information commonly collected by reservation platforms to manage user accounts and bookings. The precise scope of any additional fields or the completeness of the data set remains unconfirmed beyond the listed items.

The real-world impact

Individuals whose information appeared in the data set may face increased volume of unsolicited email or telephone contact. Passwords stored as unsalted MD5 hashes carry a higher risk of offline cracking attempts, which could lead to unauthorized access if the same credentials were reused on other services. For the organization, the incident represents a loss of user trust and potential regulatory scrutiny common to companies holding customer contact data.

Were you affected?

Users of Eatigo can begin by changing passwords on the service and any other accounts that share the same credentials. Enabling multi-factor authentication where available adds a further layer of protection. Individuals may also run a free exposure scan of their email address against known breach data sets to determine whether their information has appeared in public listings from this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.