Stayful Alleged Data Exposure
The 2016 Stayful data breach occurred in January 2016 when the MongoDB production database of Stayful (stayful.com), a San Francisco-based boutique hotel booking and bidding platform, was compromised and exfiltrated.
Exposed Data Types
7- Email addresses
- Passwords
- Password salts
- Names
- Usernames
- Physical addresses
- Travel and lodging reservations
About This Record
What information was affected in the Stayful incident?
The leaked database export (Stayful.com_SHA-256_January_2016.csv) contains platform catalog data and user account profiles, compromising:
- Identity Identifiers: Full user names, first and last names, and account usernames.
- Authentication Credentials: Passwords salted and hashed with SHA-256 algorithms.
- Contact & Physical Geolocation: Contact email addresses, physical street addresses, cities, and countries.
- Travel & Lodging Records: Boutique hotel booking bids, check-in and check-out preferences, and hotel partner communications.
How many accounts were affected?
Strict RFC canonical email validation verified 183,999 unique valid email addresses across the database.
Technical analysis and security risks
Salted SHA-256 password hashes remain susceptible to offline GPU-accelerated dictionary attacks. If affected individuals reused these credentials elsewhere, they face exposure to credential stuffing and account takeover risks.
Recommended actions for affected individuals
Former Stayful users who may have reused their credentials on active platforms should:
- Immediately change passwords across any services where credentials matched their Stayful account.
- Activate multi-factor authentication (MFA / 2FA) across personal accounts.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
