ixigo 2019 Data Breach
The 2019 ixigo data breach concerns an account dataset attributed to the India-based travel platform. The verified breach record dates the event to 3 January 2019 and reports 17,204,697 unique email addresses in the dataset.
Exposed Data Types
10- Auth tokens
- Device information
- Email addresses
- Genders
- Names
- Passwords
- Phone numbers
- Salutations
- Social media profiles
- Usernames
About This Breach
TechCrunch's 14 February 2019 report says the seller advertised approximately 18 million ixigo records as a listing separate from the other organizations offered for sale. The advertised row figure and verified unique-email count are different measures; they are neither added nor substituted for one another as a count of unique people.
The verified structured fields are authentication tokens, device information, emails, genders, names, passwords, phones, salutations, social-media profiles, and usernames. The source says passwords were stored as MD5 hashes rather than plaintext; it does not disclose salting, so none is assumed. Token type, associated service, and validity at the incident date were not published either. Payment cards, bank accounts, travel itineraries, booking contents, passports, and government identifiers are outside the verified scope.
Incident and local-data boundary
The seller's decision to list several organizations in the same period does not establish one shared access method. Although reporting relayed a theory involving a common database flaw, public evidence does not confirm ixigo's initial entry vector. Production has no ixigo import job or locally linked email, password, username, phone, or person-level dataset. The 17,204,697 value is therefore retained as an external unique-email scope; totalRecords is not presented as a local total, and the import count is zero.
Privacy and safe response
This record does not prove that a particular person travelled, made a booking, had a token used, had a password recovered, or suffered account takeover. If a password used in 2019 still exists on another service, replace only the reused copies with unique passwords. Enable multi-factor authentication on the email account and verify ticket-change, refund, or account-verification messages through a known official channel. Knowledge of a real name, phone number, or profile link does not make a sender trustworthy.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
