 "Hack exposes Zomato's weak protection of customer data, say cyber experts")
The company in a blog post claimed that the leak appeared to be an internal (human) security breach with an employee's development account getting compromised.
However, cyber security experts pointed out that Zomato was clearly lacking in its technique to protect customer data from unwanted elements .
Sajal Thomas, a cyber security consultant, claimed on Twitter that he verified the sample data being sold on the dark web and found that Zomato had used MD5 to hash passwords. MD5 is neither encryption nor encoding, and was known to be easily cracked by attacks and suffered from major vulnerabilities.
Further, he said Zomato had not used salting, a technique where random data was used as additional input to make cracking a hashed password much harder. Thomas said that it took just a few seconds to crack the hashed passwords to turn them into plain text.
Zomato in its blog post, however, claimed that it protected "passwords with a one-way hashing algorithm, with multiple hashing iterations and individual salt per password."
It said that this was to ensure that passwords could not be easily converted back to plain text. The firm claimed no credit or debit card information of users were leaked.
While Zomato says it has reset passwords of all the affected accounts, experts say that users whose data were leaked are still under threat.
"If you had a password for Zomato that you used elsewhere (on facebook or email), immediately change that password across all those accounts," tweeted Pranesh Prakash, policy director at the Centre for Internet and Society.
