Foodora Data Breach (2016): What Was Exposed & What To Do

Inside the incident

The breach involved customer records that included names, email addresses, phone numbers, physical addresses, and passwords. The passwords were stored as salted MD5 hashes or bcrypt hashes. Public reporting at the time indicated that the material circulated on various online platforms after the initial exposure.

No official statement from Foodora has been referenced in the available records regarding the method of access, the precise timeline of the intrusion, or the total volume of records confirmed as taken. The scale is recorded as affecting 583,000 individuals.

How a breach like this happens

Incidents involving customer databases at service platforms often begin with an attacker obtaining access to an internal system through compromised credentials, an unpatched application, or misconfigured storage. Once inside, the actor can copy tables containing user profiles and authentication data.

After extraction, the material is sometimes posted or shared on forums and file-sharing sites. The presence of hashed passwords means the data requires additional effort to convert into usable credentials, though older hashing methods can be more susceptible to offline attacks than modern standards.

Foodora and its sector

Foodora operated as a platform connecting customers with restaurants for delivery. Companies in this sector routinely collect and store account details, delivery locations, and contact information to fulfill orders and manage accounts.

Because the service handled recurring transactions and location data, the records held by such firms typically include identifiers that can remain useful for extended periods. A breach therefore touches both immediate account security and longer-term privacy considerations for users.

What was likely exposed

The documented exposure includes email addresses, names, phone numbers, physical addresses, and passwords stored as salted MD5 or bcrypt hashes. These categories align with the information required to create and operate customer accounts on a delivery platform.

Additional fields sometimes present in similar datasets, such as order histories or payment tokens, are not confirmed in the available reporting for this incident. The exact scope of every record therefore remains limited to the types listed above.

What's at stake

Individuals whose information appeared in the dataset face the possibility that their email addresses and phone numbers could be used for targeted phishing or that hashed passwords could be tested against other services if the same credentials were reused. Physical addresses add a layer of location data that persists beyond the immediate breach.

For the organisation, the redistribution of customer records can lead to regulatory scrutiny, loss of user trust, and costs associated with notifying affected parties and strengthening security controls. The incident illustrates the long-term circulation risk once data leaves the original environment.

What to do if you're exposed

Change passwords on the affected account and any other services where the same password may have been used. Enable multi-factor authentication where available, and monitor email and phone accounts for unusual activity.

Readers can run a free exposure scan of their email address against known breach datasets to determine whether their information appears in this or other documented incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.