Qraved Data Breach (2021): What Was Exposed & What To Do

In July 2021, the Indonesian restaurant website Qraved experienced a data breach that exposed records belonging to approximately 985,000 individuals. The incident came to light on 9 July 2021, with the data later appearing as part of a larger collection of breached records. Public reporting indicates that the exposed information included names, email addresses, phone numbers, dates of birth, and passwords stored as MD5 hashes.

Inside the incident

The breach affected nearly one million unique email addresses along with associated personal details. Reporting on the event states that the data was subsequently redistributed within a broader corpus rather than released in isolation. No further technical details on the method of access or the precise timeline of the intrusion have been disclosed in available records.

How a breach like this happens

Incidents involving the exposure of user account data commonly occur when attackers obtain unauthorized access to an organization's database or backup systems. This can result from remote exploitation of software vulnerabilities, compromised credentials used by staff, or misconfigured storage that leaves data accessible. Once obtained, the records are sometimes packaged and shared or sold among multiple parties, which can lead to the same dataset appearing in several collections over time.

Who is Qraved?

Qraved operates as an online platform focused on restaurants in Indonesia, providing users with information and services related to dining options. Organizations in this sector routinely collect account details from customers who register for reviews, reservations, or promotional features. A breach at such a service is consequential because the stored data can be used to target individuals across multiple online services where similar credentials or contact information may be reused.

The information in question

The records reported as exposed include names, email addresses, phone numbers, dates of birth, and passwords stored as MD5 hashes. The exact scope of additional fields or the full contents of any database remain unconfirmed beyond these categories. MD5 hashing for passwords is a known legacy method that does not incorporate modern safeguards such as salting or iteration.

What's at stake

For individuals, the presence of email addresses combined with phone numbers and dates of birth can facilitate targeted phishing or account-recovery attempts on other platforms. Passwords stored as MD5 hashes may be more susceptible to offline cracking attempts if the hashes become available. For the organization, the incident adds to the body of publicly discussed breaches involving customer records in the hospitality sector, which can affect user trust and prompt reviews of data-handling practices.

What to do if you're exposed

Individuals who suspect their information may be involved should change passwords on the affected service and any other accounts that reuse the same credentials. Enabling multi-factor authentication where available adds a further layer of protection. Readers can also run a free exposure scan of their email address against known breach data to check for appearances in documented incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.