Zomato Data Breach (2017): What Was Exposed & What To Do

In May 2017, a data breach at the restaurant guide platform Zomato exposed records associated with roughly 16.5 million accounts. The incident resulted in email addresses, usernames, and salted MD5 password hashes being redistributed online. The event is significant because credentials of this type can be tested against other services, and the redistribution increases the chance that the information will remain available to others over time.

Breaking down the breach

The breach was reported on May 17, 2017. Public records indicate that nearly 17 million accounts were affected, with the data later appearing in online circulation. The material contained email addresses, usernames, and salted MD5 hashes of passwords; the hashes were not present on every account. The dataset was later supplied to Have I Been Pwned by security researcher Adam Davies. No further technical details on the method of access or the precise timeline of the intrusion have been disclosed in available reports.

How a breach like this happens

Incidents involving online service accounts often begin with an attacker obtaining entry through a vulnerable web application, a compromised administrative credential, or an exposed database interface. Once inside, the attacker can copy user tables that store login identifiers and password representations. When password data is stored only as hashes rather than plain text, the immediate value of the stolen material depends on how easily those hashes can be processed offline. After extraction, the data may be shared or sold, extending the period during which the information remains usable.

Who is Zomato?

Zomato operates a platform that lists restaurants, provides reviews, and supports online ordering and reservations. Like other services in the hospitality and food-delivery sector, it maintains accounts for users who search for venues or place orders. These accounts routinely include contact details and authentication data, making the platform a repository of information that individuals use across multiple sites. A compromise at such a service therefore touches a broad user base whose credentials may be reused elsewhere.

The information in question

The records named in connection with the incident include email addresses, usernames, and salted MD5 hashes of passwords. The hashes were not recorded for every account. No additional categories of data, such as payment details or physical addresses, are identified in the available reporting. Because the exact contents of every record remain unconfirmed beyond these fields, it is not possible to state with certainty what other information, if any, was present.

What's at stake

For individuals, the primary concern is that email addresses paired with password hashes can be used in attempts to access other accounts where the same credentials or minor variations are employed. Salted hashes require additional computational effort to test, yet once processed they can still yield working passwords. For the organisation, the incident creates operational costs related to notifying users, resetting credentials, and reviewing security controls. Both effects unfold over months or years as the data circulates.

What to do if you're exposed

Anyone who used a Zomato account around the time of the incident should change the password on that account and on any other service where the same password or a close variation was used. Enabling multi-factor authentication on important accounts reduces the value of a leaked password. It is also prudent to review recent login activity on frequently used services. Readers can run a free exposure scan of their email address against known breach data to determine whether their information appears in this or other documented incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.