The restaurant search and discovery service Zomato has been hacked. Claiming to have 120 million monthly users, the company revealed that around 17 million of its customers have their accounts' credentials stolen.
While financial and personal details remain safe, Zomato noted that the stolen passwords should be safe because they were hashed.
Furthermore, passwords of Zomato's 120 million users are reportedly salted as well. What this means, characters are added at random before the passwords are hashed, rendering them unintelligible even if the hash is translated.
Though Zomato said that it has reset the passwords on the affected accounts, the company said that users should change their passwords on any other online accounts that use the same password/email combination.
"We hash passwords with a one-way hashing algorithm, with multiple hashing iterations and individual salt per password," explained Zomato’s Gunja Patidar, in a blog post. "This means your password cannot be easily converted back to plain text. We however, strongly advise you to change your password for any other services where you are using the same password."
According to HackRead, a user that goes the name "nclay" claimed to have hacked Zomato, and was willing to the stolen data on a popular Dark Web marketplace. The whole package was set to be sold for about 1,000 bitcoins. HackRead adds that the vendor also published data and evidence to prove it was genuine.
In the blog post, Zomato has attributed human error as the cause of the breach. An employee's development account got compromised. "Our team is actively scanning all possible breach vectors and closing any gaps in our environment," the post said.
Zomato was founded in India in 2008. Operating in multiple cities, its services include providing restaurant-focused information such as photos, menus and locations.
