RedDoorz Hotel Booking Platform Breach Exposes 5.9 M User Accounts
What Happened – In September 2020 the RedDoorz hotel‑management and booking service suffered a data breach that compromised 5,890,277 user records. The exposed data set includes names, email addresses, phone numbers, genders, dates of birth and password hashes (bcrypt).
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of inadequate credential protection and the need for continuous monitoring of password‑storage controls.
- Highlights the importance of maintaining auditable evidence that password hashing meets industry‑accepted standards (e.g., salted bcrypt) and that access to credential stores is tightly governed.
- Aligns with the control objective of Identity & Access Management—a single control that satisfies multiple frameworks (NIST CSF 2.0, ISO 27001, etc.).
Who Is Affected – Hospitality and travel‑booking SaaS providers; their customers whose personal data were stored on the platform.
Recommended Actions
- Verify that all password hashes use strong, salted algorithms (bcrypt, Argon2) and rotate any compromised credentials.
- Implement multi‑factor authentication for administrative access to credential stores.
- Capture and retain logs of credential‑store access as audit evidence for control‑assurance reviews.
Technical Notes – The breach appears to stem from unauthorized access to the user database; no specific CVE or vulnerability was disclosed. Passwords were stored as bcrypt hashes, which mitigates but does not eliminate risk if the hash values are exfiltrated. Source: [Have I Been Pwned – RedDoorz breach]