UPDATE: Zomato's Data Theft Disclosure Raises More Questions Than It Answers

Zomato's disclosure that it suffered a cyber security breach and a subsequent update about it plugging the leak raises questions whether India's most well funded food tech company has been fully transparent about the extent of the attack and potential financial risks to customers.

The start-up led by Deepinder Goyal, on May 18th said 17 million user records were stolen from its database but that no payment or credit card data was stolen or leaked.

In its official blog, the online restaurant guide and food delivery app said since the stolen information was encrypted it could not easily be converted to plain text by hackers.

[blockquote data-width='100']

"We hash passwords with a one-way hashing algorithm, with multiple hashing iterations and individual salt per password. This means your password cannot be easily converted back to plain text. We however, strongly advise you to change your password for any other services where you are using the same password," Gunjan Patidar, Chief Technology Officer wrote.

[/blockquote]

However, the blog post lacked specifics about when and where the attack took place and how Zomato discovered the same. The post also did not talk about accounts that were tied to Facebook and Google or whether Zomato had reached out to affected users, individually.

(In its updated post the company now says it did not have any passwords for users that used Facebook and Google to log in to its site and therefore those passwords are safe.)

There is also evidence that the original blog post was edited a few times as this tweet from Pranesh Prakash, Policy Director at the Centre for Internet and Society (CIS) in Bangalore, suggests.

@HackRead @Zomato The old #Zomato blog post gave very bad advice and didn't mention salting. Revised post mentions salting and gives better advice #databreach pic.twitter.com/a4JROjBPrl

— Pranesh Prakash (@pranesh) May 18, 2017

ZOMATO DATA WAS UP FOR SALE ON DARK WEB

Several hours before Zomato's first official blog post on the breach, HackRead reported 17 million hacked account details from Zomato were up for sale on Dark Web. HackRead also reported that it found a vendor going by the name "nclay", who claimed to have hacked Zomato and was demanding $1,001.43 (Bitcoin 0.5587) for the data.

This is important as Zomato's original post did not mention the stolen data was up for sale on Dark Web.

"Zomato is spot on about everything in their blog post but one and the most crucial thing they didn't mention properly is that fact that the leaked passwords are encrypted with simple MD5 hashes which can be decrypted within a few seconds," Waqas Amir  who broke the story for HackRead told BOOM in an email.  Amir, who is based in Milan, is also the founder and editor of HackRead.

MD5 is an algorithm used to hash passwords but has been known to suffer from extensive vulnerabilities.

Amir told BOOM that he reached out to Zomato through a contact form on their website and messaged them through their verified Facebook page, before publishing his story but did not receive a response from the company.

BOOM reached out to Zomato separately but the company declined to comment beyond what the blog posts state.

"There were two clear objections. First, the fact that the way they stored the password and the "hashing algorithm" they used for this purpose, was completely inappropriate," Pranesh Prakash, Policy Director at CIS, told BOOM.

"Second is that the initial statements they put out grossly underplayed the threat to users' passwords, and provided bad advice. Thankfully, they corrected that in later updates on their blog," Prakash said.