EatStreet Data Breach (2019): What Was Exposed & What To Do

In May 2019, the online food ordering service EatStreet reported a data breach that affected 6.4 million customers. The incident exposed names, phone numbers, physical addresses, email addresses, dates of birth, genders, partial credit card data, and passwords stored as bcrypt hashes. The scale of the event means that a large volume of personal and contact information tied to food delivery accounts is now outside the company's control. Individuals whose records were involved face the possibility that their details could be used in targeted scams, account takeovers, or further data aggregation.

Breaking down the breach

The breach was publicly reported on May 3, 2019. It involved 6.4 million customer records from EatStreet's systems. The data obtained included names, phone numbers, physical addresses, email addresses, dates of birth, genders, partial credit card data, and passwords stored as bcrypt hashes. No further details on the method of access, the duration of the intrusion, or the precise timeline of data removal have been disclosed in available reporting.

How a breach like this happens

Breaches affecting customer databases at online service providers often begin with an attacker gaining unauthorized entry to internal systems through vulnerabilities in web applications, weak authentication controls, or compromised credentials. Once inside, the attacker can locate and extract stored records, particularly when data is kept in a single repository without strong segmentation. Passwords hashed with bcrypt remain computationally difficult to reverse, yet the presence of other identifying fields still allows the records to be linked to real individuals.

About EatStreet

EatStreet operates as an online platform that connects customers with local restaurants for food ordering and delivery. Services of this type routinely collect names, addresses, phone numbers, email addresses, and payment details to process orders and manage accounts. A breach at such a company is consequential because the data directly ties individuals to their physical locations and purchasing patterns, information that retains value over time for purposes ranging from marketing to more targeted misuse.

What data was at risk

The records confirmed as obtained in the incident contain names, phone numbers, physical addresses, email addresses, dates of birth, genders, partial credit card data, and passwords stored as bcrypt hashes. Exact combinations present in every record are not specified. Organizations in this sector commonly hold additional fields such as order histories and account preferences, but whether those elements were included remains unconfirmed.

Why it matters

For affected individuals, the exposure of addresses and contact information alongside partial payment details increases the chance of receiving fraudulent communications that reference real personal facts. Hashed passwords limit immediate account access on other sites if users followed password reuse practices, yet the combination of identifiers still supports identity verification attempts or social engineering. For the organization, the incident highlights the long-term costs of storing customer data at this volume, including potential regulatory scrutiny and the need to rebuild trust with users whose records were taken.

If your data was in this breach

Begin by changing the password on your EatStreet account and any other service where the same password may have been used. Enable multi-factor authentication where available. Monitor bank and credit card statements for unusual activity, given the presence of partial card data. You can also run a free exposure scan of your email address against known breach data to check whether your information appears in additional incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.