How the DOJO App Database Breach Led to 761,000 Stolen Accounts

HEROIC analysts uncovered that DOJO, a mobile restaurant discovery app based in the United Kingdom, suffered a data breach in February 2017 that exposed 761,698 user accounts. The recieved data included email addresses, first and last names, and password hashes using both MD5 and bcrypt algorithms. This breach has since resurfaced in active circulation on dark web forums and stealer log channels, meaning the risk to affected users is ongoing rather than historical.

Why Your Name Combined with Your Email Is Dangerous

When attackers have your first name, last name, and email address together, they can craft highly convincing phishing messages that appear personalized and legitimate. Combined with a cracked password hash, this data gives criminals everything they need to take over accounts or impersonate you. MD5 password hashes in partcular are well known to be weak and can often be cracked within hours using widely available tools.

What Was Exposed in the DOJO Breach

• Email Address
• Password Hash
• First Name
• Last Name

Why Weak Hashing Put 761,000 Users at Risk

DOJO stored some passwords using MD5, an algorithm that the security community has known to be unsafe for years. Attackers with access to MD5 hashes can crack many of them within minutes using freely accessable cracking tools. Even for accounts that used the stronger bcrypt algorithm, the exposure of names and email addresses still enables targeted phishing and identity fraud. When this data ends up in credential stuffing attacks, criminals test these credentials across thousands of websites automatically.

How a Database Breach Works

A database breach occurs when an attacker exploits a vulnerability in a website or app to gain unauthorized access to its user database. In this case, DOJO's backend was compromised, and the full user table was copied and exfiltrated. The stolen database, containing nearly three quarters of a million records, was later shared and sold on underground markets, where it continues to be traded today.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches over 400 billion records, including data from the DOJO breach and thousands of other incidents. Enter your email address to instantly find out whether your information was part of this or any other known breach, and get steps to protect yourself right away.