Hurb Data Breach (2019): What Was Exposed & What To Do

What happened

The breach occurred around March 2019. Public reporting of the incident dates to 14 March 2019, although the precise date the intrusion began remains undisclosed. The data set that surfaced the following year contained more than 20 million customer entries and included email addresses, IP addresses, names, dates of birth, phone numbers, social-media profiles and passwords stored as unsalted MD5 hashes. No official statement from Hurb detailing the method or duration of the intrusion has been referenced in the available records.

How a breach like this happens

Incidents involving large customer databases commonly begin with the exploitation of an internet-facing application, a misconfigured server or the use of stolen administrative credentials. Once initial access is obtained, attackers often move laterally to database servers and extract tables containing user records. The extracted files are then compressed and later posted or sold on public or semi-public forums. In many cases the original compromise is not detected until the data reappears elsewhere.

Hurb and its sector

Hurb, formerly known as Hotel Urbano, operates as an online travel agency based in Brazil. Companies in this sector routinely collect and store customer details required for booking flights, hotels and holiday packages. The volume of personal information held makes such platforms attractive targets, because the records can be used for account takeover attempts, marketing list compilation or identity-related fraud.

What was likely exposed

The records that appeared online contained email addresses, IP addresses, names, dates of birth, phone numbers, social-media profiles and passwords stored as unsalted MD5 hashes. These data types are confirmed in the material supplied to breach-tracking services. Whether additional fields such as payment-card details or booking histories were also present has not been disclosed in the public record.

The real-world impact

Individuals whose records were included now face the possibility that their email addresses and passwords have been circulated among parties who attempt automated logins on other sites. Because the passwords were stored without salting, they are more susceptible to offline cracking than modern hashed values. For the company, the incident adds to the body of publicly available evidence that its systems once held a large volume of customer data in a form that could be extracted and redistributed.

What to do if you're exposed

Anyone who used Hurb is advised to change the password associated with their Hurb account and to avoid reusing that password elsewhere. Enabling multi-factor authentication on email and other important accounts reduces the chance that a leaked password alone will grant access. Running a free exposure scan of the email address used with Hurb against known breach data provides a quick check on whether the address has appeared in other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.