Yatra Booking Platform Exposes Over 5 Million User Records in Critical Breach
What Happened
In September 2013 the Indian travel‑booking website Yatra suffered a data breach that exposed 5,033,997 user accounts. The compromised dataset included email addresses, physical and mailing addresses, dates of birth, phone numbers, plain‑text passwords, and personal identification numbers (PINs). The breach was first identified through the Vigilante.pw breach‑dump repository and later confirmed by Have I Been Pwned.
Why It Matters for Compliance & Audit Readiness
- Demonstrates the risk of storing credentials and personally identifiable information (PII) without strong encryption – a control‑assurance gap that continuous monitoring should flag.
- Highlights the need for documented evidence of secure credential handling (e.g., salted hashing, vault storage) to satisfy GDPR, ISO 27001, and PCI‑DSS audit requirements.
- Shows how a single vendor‑side failure can cascade into downstream compliance violations for partners that rely on Yatra’s data processing practices.
Who Is Affected
- Online travel agencies and booking platforms
- Hospitality and tourism service providers that integrate Yatra’s API
- Consumers of Yatra’s services (approximately 5 million Indian residents)
Recommended Actions
- Review any third‑party integrations with Yatra and assess exposure of shared data.
- Validate that password and PIN storage follows industry‑standard hashing (e.g., Argon2, bcrypt) and that PII is encrypted at rest.
- Request a formal incident‑response report from Yatra, including timelines, root‑cause analysis, and remediation steps.
- Update continuous control‑assurance dashboards to include credential‑storage health checks for all vendors.
Technical Notes
- Attack vector: Likely unauthorized database access; exact intrusion method not disclosed.
- CVE(s): None reported in public sources.
- Data types exposed: Email addresses, physical addresses, dates of birth, phone numbers, plain‑text passwords, PINs, full names.
Source: https://haveibeenpwned.com/api/v3/breach/Yatra