RedDoorz Data Breach (2020): What Was Exposed & What To Do

In September 2020, RedDoorz reported a data breach that exposed more than 5.8 million user accounts. The incident involved names, email addresses, phone numbers, genders, dates of birth, occupations, and passwords stored as bcrypt hashes. The scale of the exposure means that a substantial number of individuals who used the platform for hotel bookings had personal details placed at risk of misuse. Because the breach was made public on 4 September 2020, affected users have had a defined point at which to begin monitoring for subsequent problems such as unwanted contact or account takeovers.

Breaking down the breach

Public records state that the breach occurred in September 2020 and affected more than 5.8 million accounts. The data types listed as exposed are names, email addresses, phone numbers, genders, dates of birth, occupations, and passwords stored as bcrypt hashes. No further technical details about the method of access or the duration of the intrusion have been disclosed in available reporting.

How a breach like this happens

Incidents involving online platforms that store user account information often begin with an attacker obtaining access to a database through unpatched software, weak authentication controls, or compromised credentials. Once inside, the attacker can copy tables containing personal fields and password hashes. The use of bcrypt for password storage indicates an attempt to slow down offline cracking attempts, though the presence of any password data still requires users to treat those credentials as potentially compromised.

Who is RedDoorz?

RedDoorz operates a hotel management and booking platform that connects travellers with accommodation providers, primarily in Southeast Asia. Services of this kind routinely collect and retain customer details required for reservations, identity verification, and account management. A breach at such a company therefore touches data that many people supply when arranging travel, which can include contact information and identifiers used across other services.

What data was at risk

The breach listing names the following data elements as exposed: dates of birth, email addresses, genders, names, occupations, passwords stored as bcrypt hashes, and phone numbers. Exact confirmation of every record affected or of any additional fields remains unavailable from public sources. Organisations in the accommodation sector commonly hold similar categories of information to process bookings and comply with regulatory requirements, but the precise contents of this incident are limited to the types already stated.

Why it matters

Exposure of names, contact details, and dates of birth can enable targeted phishing or identity-related fraud, while hashed passwords increase the chance that attackers will attempt to reuse credentials on other sites. For RedDoorz, the incident creates obligations around user notification and potential regulatory scrutiny common to data-protection regimes in the regions it serves. Individuals may face follow-on risks that unfold over months or years rather than immediately after disclosure.

Were you affected?

Users who created accounts on RedDoorz before September 2020 should assume their information may have been included and change passwords on that service and any other site where the same credentials were used. Enabling multi-factor authentication where available reduces the chance of account takeover. Running a free exposure scan of the email address associated with the account can show whether the address has appeared in other known breach datasets, providing a starting point for further checks.

AICompiled with AI assistance from public sources and published under our editorial standards.