Rural Travel Platform Breach: Escapada Rural Leaked 2.9 Million Records

HEROIC analysts found a dataset belonging to Escapada Rural posted to a public hacking forum on May 24, 2023. The platform, which connects travelers with rural accommodation listings across Spain, had approximately 2.9 million user records exposed in what appears to be a direct database dump. The compromised file contained a notably complete picture of each user, going well beyond a simple email list and into demographic detail that makes the data particularly useful for targeted attacks.

Personal Data From 2.9 Million Spanish Travelers Now Accessible to Attackers

With full names, email addresses, phone numbers, birthdates, and gender details in hand, an attacker can build convincing impersonation profiles. They can craft phishing messages that reference your real name, contact you on your actual phone number, and even time outreach around your birthday. The structured nature of the dump, recieved in organized database format, means threat actors can sort, filter, and target at scale with very little effort.

What Was Exposed in the Escapada Rural Breach

• Email addresses
• Phone numbers
• First and last names
• Dates of birth
• Gender
• Last login details

Why This Matters for Affected Users

This kind of PII bundle is exactly what fuels identity theft, account takeover, and fraud. Attackers cross-reference leaked datasets from multiple breaches, and when your name, phone, email, and birthdate all show up together, that combination becomes a master key. Credential stuffing becomes possible on any site where you used the same email. Social engineering calls become more convincing because the caller already knows who you are. The risk is not just to your Escapada Rural account but to every account tied to that email address.

How a Database Breach Works

A database breach typically occured when an attacker exploits a vulnerability in a web application, such as an unpatched SQL injection flaw or misconfigured access controls, to query and extract the underlying database directly. Rather than attacking individual users, the threat actor pulls the entire user table in one operation. The resulting file is then compressed and uploaded to a forum or dark web marketplace where it is sold, traded, or posted publicly. Once that file is out there, it cannot be taken back.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records to tell you exactly what information of yours has appeared in known breaches. If you have ever used Escapada Rural or any Spanish travel or accommodation platform, running a scan takes less than a minute and gives you a clear picture of your current exposure. Start your free scan at HEROIC.com today.