Zomato Breach Exposes 16.5 M User Accounts (Emails, Usernames, Password Hashes)
What Happened — In May 2017 Zomato’s platform was hacked, resulting in the public release of 16,472,873 user records. The leaked data includes email addresses, usernames and, for many accounts, salted MD5 hashes of passwords. The breach was disclosed to Have I Been Pwned by security researcher Adam Davies.
Why It Matters for Trust & Control Assurance
- Highlights the need for continuous credential‑management controls that can be evidenced in audits (e.g., strong hashing, MFA, credential rotation).
- Demonstrates why organizations must monitor for credential leakage and retain immutable logs as proof of due‑diligence.
- Aligns with the identity and access control objective that maps to multiple frameworks (NIST CSF, ISO 27001, etc.) and is the focus of Verisq’s ACCESS_CONTROLS capability.
Who Is Affected — Food‑tech platforms, consumer web services, restaurants that rely on Zomato’s API, and any organization storing similar credential data.
Recommended Actions
- Verify that password storage uses adaptive, memory‑hard algorithms (bcrypt, Argon2) and re‑hash any MD5‑derived values.
- Enforce multi‑factor authentication and compel users to reset passwords that may have been compromised.
- Deploy continuous monitoring for credential leaks (e.g., HIBP feeds) and retain remediation evidence for audit readiness.
Source: Have I Been Pwned – Zomato breach
Technical Notes
- Attack vector not publicly disclosed; breach appears to be a classic credential‑theft compromise.
- Exposed data types: email addresses, usernames, salted MD5 password hashes (not present on all accounts).
Source: HIBP breach details