OrderSnapp Data Breach (2020): What Was Exposed & What To Do

In June 2020 a data incident at OrderSnapp exposed records belonging to 1.3 million individuals. The exposed information included email addresses, names, phone numbers, dates of birth and passwords stored as bcrypt hashes. The incident was reported on 29 June 2020 after the data set reached Have I Been Pwned through the service dehashed.com. For people whose details appear in the records, the main practical concern is that email addresses combined with other identifiers can be used for targeted phishing or account takeover attempts if the hashed passwords are later cracked.

Breaking down the breach

The available information states that OrderSnapp, a restaurant solutions provider, experienced a data breach in June 2020. The breach resulted in the exposure of 1.3 million unique email addresses along with associated names, phone numbers, dates of birth and passwords stored as bcrypt hashes. No further technical details about the method of access, the duration of the intrusion or the precise volume of records beyond the 1.3 million unique emails have been disclosed in public reporting. The data set was subsequently shared with the Have I Been Pwned database by dehashed.com.

How a breach like this happens

Incidents involving the exposure of customer records from service providers commonly begin with an attacker obtaining unauthorised access to an organisation’s systems. This access may occur through unpatched software, compromised credentials, misconfigured databases or third-party integrations that are not adequately secured. Once inside, an attacker can locate and copy stored data tables. In many cases the data is then offered or sold on forums or data-trading platforms, after which it may be submitted to public breach-notification services. The use of bcrypt hashing for passwords indicates that the organisation applied a recognised one-way hashing function, though the strength of protection still depends on password complexity chosen by users.

OrderSnapp and its sector

OrderSnapp operates in the restaurant technology sector, supplying ordering and management solutions to food-service businesses. Companies in this field routinely collect contact details, account credentials and limited personal identifiers from both restaurant operators and end customers who place orders through their platforms. Because these systems often connect to payment processors, loyalty programmes and delivery services, they accumulate data sets that include names, contact information and dates of birth. A breach at such a provider therefore affects both the businesses that rely on the platform and the individuals whose order or account records are held.

The information in question

The records reported as exposed contain email addresses, names, phone numbers, dates of birth and passwords stored as bcrypt hashes. No additional categories of data, such as payment card details or physical addresses, are named in the available reporting. The exact contents of every record remain unconfirmed beyond the fields listed above, and it is not publicly known whether every one of the 1.3 million email addresses is accompanied by the full set of other fields.

The real-world impact

Individuals whose email addresses and names appear in the data set face an elevated risk of receiving phishing messages crafted to appear relevant to their restaurant accounts or past orders. Phone numbers and dates of birth can assist in account-recovery processes or identity-verification attempts elsewhere. Passwords protected by bcrypt hashes require computational effort to reverse, but weak or reused passwords remain vulnerable if an attacker invests resources in cracking them. For OrderSnapp the incident creates operational and reputational consequences, including the need to notify affected users, review access controls and potentially face regulatory scrutiny depending on the jurisdictions involved.

Were you affected?

Anyone who created an account with OrderSnapp or placed an order through one of its client restaurants before June 2020 should treat their email address as potentially known to third parties. The immediate steps are to change the password on any OrderSnapp-related account and to avoid reusing that password elsewhere. Users can also run a free exposure scan of their email address against known breach data sets to determine whether their information has appeared in this or other incidents. Monitoring incoming messages for unusual requests and enabling multi-factor authentication on linked accounts further reduces the chance of misuse.

AICompiled with AI assistance from public sources and published under our editorial standards.