The Eatigo Breach Means Someone Has Your Name, Phone, and Password Hash

HEROIC analysts identified the Eatigo breach while monitoring dark web forums where the database was actively being traded and discussed. The breach occured in October 2018, exposing 2,765,564 records from this Thailand-based restaurant reservation service. The data included email addresses, phone numbers, first and last names, gender, and password hashes stored using unsalted MD5, a hashing method that is partcularly vulnerable to rapid cracking with modern hardware. The combination of personal identifiers alongside crackable password hashes makes this dataset high-value for targeted attacks.

What Attackers Can Do With Eatigo's Names, Phones, and MD5 Hashes

Unsalted MD5 hashes can be reversed in seconds for common passwords using precomputed rainbow tables. Once cracked, attackers have a full profile: real name, phone number, email address, and working password. This combination enables highly convincing phishing calls and SMS scams, SIM swap fraud using the phone number, account takeover across services where the password was reused, and identity theft using the verified name and contact details. Attackers who recieved this data can also sell individual profiles to specialized fraud operators who target food delivery and hospitality loyalty accounts for their stored payment methods.

What Was Exposed in the Eatigo Breach

• Email Address
• Phone Number
• Password Hash (MD5, unsalted)
• First Name
• Last Name
• Gender

Why 2.7 Million Records With Personal Details Enables Identity Theft at Scale

The Eatigo breach is seperate from a simple credential leak because it bundles identity data with crackable passwords. Credential stuffing attacks use the email and cracked password to attempt logins across streaming services, food delivery apps, and financial platforms. When those attempts succeed, attackers gain access to stored payment cards, reward points, and personal account history. At 2.7 million records, even a low success rate translates to tens of thousands of compromised accounts and significant financial fraud exposure for affected users.

How a Database Breach Works

A database breach occurs when an attacker gains unauthorized access to a platform's data infrastructure, typically through exploitation of application vulnerabilities, compromised administrative credentials, or misconfigured cloud storage. The attacker extracts user tables and distributes them through dark web marketplaces or forum posts. Breaches involving large consumer platforms like Eatigo are particularly valuable because the victim pool is broad and the associated personal data supports multiple types of downstream fraud.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches more than 400 billion compromised records, including the Eatigo dataset, to identify whether your email address was part of this or any other known breach. Run a free scan at HEROIC today and find out exactly what data of yours is circulating on the dark web before someone else acts on it.