Eatigo Breach Exposes 2.79 M User Accounts with Unsalted MD5 Password Hashes
What Happened — In October 2018 the restaurant‑reservation service Eatigo suffered a data breach that exposed 2,789,609 user records. The leaked data included email addresses, names, phone numbers, social‑media profiles, genders, and passwords stored as unsalted MD5 hashes.
Why It Matters for Trust & Control Assurance —
- Weak password hashing is a classic control gap that a continuous control‑assurance program should detect and remediate.
- Demonstrating defensible evidence of strong credential‑management policies is essential for audit readiness across multiple frameworks.
- Ongoing monitoring of credential storage and hashing algorithms provides the audit trail needed to prove due‑diligence after an incident.
Who Is Affected — Hospitality‑tech SaaS providers, restaurant reservation platforms, and any service handling large volumes of consumer credentials.
Recommended Actions —
- Replace unsalted MD5 hashes with a modern, salted algorithm (e.g., Argon2, bcrypt, scrypt).
- Enforce password‑strength policies and mandatory rotation for compromised accounts.
- Implement continuous monitoring of credential storage configurations and generate immutable audit logs.
- Conduct a credential‑management control audit and map findings to your framework of record.
Technical Notes — The breach appears to stem from a misconfiguration that left a database of user credentials accessible without proper authentication. Passwords were stored as unsalted MD5 hashes, a practice vulnerable to rainbow‑table attacks. No specific CVE is associated with the incident. Source: Have I Been Pwned – Eatigo breach