The RedDoorz Breach Happened in 2020. The Data Is Still Circulating.

HEROIC analysts confirmed the RedDoorz breach occured in September 2020, exposing 5,889,258 user records from the Singapore-based hotel booking and management platform. The leaked dataset included email addresses, phone numbers, bcrypt password hashes, first and last names, gender, and birthday data, and has continued to circulate across underground channels in the years since.

What Attackers Can Do With RedDoorz Phone Numbers, Birthdays, and Gender Data

RedDoorz victims face risks that go beyond simple password reuse. Phone numbers combined with full names and birthdays are partcularly useful for SIM-swap fraud, where attackers convince mobile carriers to transfer a victim's number to an attacker-controlled SIM. Once a phone number is hijacked, SMS-based two-factor authentication on banking and email accounts is bypassed entirely, enabling full account takeover without ever cracking a password.

What Was Exposed in the RedDoorz Breach

• Email Address
• Phone Number
• Password Hash
• First Name
• Last Name
• Gender
• Birthday

Why the RedDoorz Breach Timing Still Matters in 2025

The RedDoorz breach happened in September 2020. That data went public and has been beleived to be in active use across credential stuffing operations ever since. Five years is long enough for most users to have forgotten about it, but not long enough for the threat to expire. Attackers rely on aging dumps precisely because users stop monitoring them, opening the door to account takeover, identity theft, and financial fraud targeting travel and hospitality accounts.

How a Database Breach Works

A database breach occurs when attackers gain unauthorized access to a company's user data store, typically through exploited web vulnerabilities or stolen access credentials. The attacker exports records in bulk directly from the backend database. In RedDoorz's case, the exported records covered nearly 5.9 million accounts containing a rich mix of personal identifiers, phone numbers, and hashed passwords that continue to fuel downstream attacks.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks your email address against more than 400 billion leaked records, including the RedDoorz breach. Visit HEROIC.com to run a free scan and find out whether your information is still circulating online.