2.8 Million Eatigo and 1.1 Million RedMart Accounts Exposed Following Data Breach
Another couple of massive data breaches took place over the last few days. The breaches affected restaurant reservation platform Eatigo and online supermarkets RedMart.
A combined total of nearly 4 million accounts were affected. On the last day of October, Eatigo informed its customers that it became the victim of a "data security incident" that involved bad actors accessing their usual target - customer account databases. The Eatigo records were at least a year and a half old and included names, e-mails and phone numbers of Eatigo customers.
The stolen records surfaced for sale on the dark web - a total of 2.8 million Eatigo customer records. The same sale advertisement section on the dark web forum also listed 1.1 million RedMart accounts for sale.
RedMart is operated by parent entity Lazada, which is, in turn, part of Chinese multinational supergiant Alibaba Group. The company announced that its own customer records accessed illegally were also "more than 18 months out of date". The bad actors were able to only access RedMart accounts - accounts made with Lazada's e-commerce platform were unaffected. Lazada further reported that the breached databases were with a third-party hosting service provider.
The fact that the data in both databases was at least 18 months old is not much consolation, given the nature of the records contained in them. Your name, gender and e-mail address are not exactly items that you change every couple of years, after all.
The post on the dark web forum listed Eatigo customer phone numbers and Facebook IDs and tokens as well. The Lazada dump sale ad included e-mails, addresses, names, phones and "partial credit cards".
Can you really guard against a data breach?
The only thing customers can do in similar situations is change their passwords, enable multi-factor authentication on any services that support it and hope they did not reuse passwords across different platforms. There is little you can do to guard yourself against a data breach on a remote platform, as your information will always be exposed after a successful attack, no matter how good your passwords are.
The only thing you can do as a customer and user is follow good security practices, never reuse passwords and do your best to mitigate possible damage following a breach, changing your password and enabling MFA.
