[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f9k3cmr1df19i":3,"$f2qcounxh4ubl9":62},{"success":4,"breach":5},true,{"_id":6,"name":7,"title":8,"slug":9,"domain":10,"breachDate":11,"addedDate":12,"publishedAt":13,"modifiedDate":14,"contentUpdatedAt":14,"source":15,"sourceUrl":16,"sourceUrls":17,"pwnCount":19,"affectedCount":19,"affectedCountStatus":20,"affectedCountLowerBound":13,"affectedCountUnit":21,"hasEnglishDescription":4,"contentLocale":22,"availableLocales":23,"translations":33,"severity":44,"dataClasses":45,"description":53,"seoTitle":54,"seoDescription":55,"logoUrl":56,"isVerified":57,"isSensitive":57,"isSpamList":57,"isMalware":57,"company":58},"6aadcf4d83f5dae3fb3f8b2a","Stayful 2016","Stayful Alleged Data Exposure","stayful-2016","stayful.com","2016-01-15T00:00:00.000Z","2026-09-18T23:54:53.314Z",null,"2026-10-10T08:26:39.866Z","Stayful boutique hotel booking platform MongoDB database leak","https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FBoutique_hotel",[16,18],"https:\u002F\u002Ftherecord.media\u002F",183999,"known","email_identifiers","en",[22,24,25,26,27,28,29,30,31,32],"tr","zh","hi","es","ar","fr","bn","pt","ru",{"en":34,"tr":35,"zh":36,"hi":37,"es":38,"ar":39,"fr":40,"bn":41,"pt":42,"ru":43},{"slug":9},{"slug":9},{"slug":9},{"slug":9},{"slug":9},{"slug":9},{"slug":9},{"slug":9},{"slug":9},{"slug":9},"High",[46,47,48,49,50,51,52],"Email addresses","Passwords","Password salts","Names","Usernames","Physical addresses","Travel and lodging reservations","\u003Cp>\u003Cstrong>The 2016 Stayful data breach\u003C\u002Fstrong> occurred in January 2016 when the MongoDB production database of \u003Cstrong>Stayful\u003C\u002Fstrong> (\u003Ccode>stayful.com\u003C\u002Fcode>), a San Francisco-based boutique hotel booking and bidding platform, was compromised and exfiltrated.\u003C\u002Fp>\u003Ch2>What information was affected in the Stayful incident?\u003C\u002Fh2>\u003Cp>The leaked database export (\u003Ccode>Stayful.com_SHA-256_January_2016.csv\u003C\u002Fcode>) contains platform catalog data and user account profiles, compromising:\u003C\u002Fp>\u003Cul>\u003Cli>\u003Cstrong>Identity Identifiers:\u003C\u002Fstrong> Full user names, first and last names, and account usernames.\u003C\u002Fli>\u003Cli>\u003Cstrong>Authentication Credentials:\u003C\u002Fstrong> Passwords salted and hashed with SHA-256 algorithms.\u003C\u002Fli>\u003Cli>\u003Cstrong>Contact & Physical Geolocation:\u003C\u002Fstrong> Contact email addresses, physical street addresses, cities, and countries.\u003C\u002Fli>\u003Cli>\u003Cstrong>Travel & Lodging Records:\u003C\u002Fstrong> Boutique hotel booking bids, check-in and check-out preferences, and hotel partner communications.\u003C\u002Fli>\u003C\u002Ful>\u003Ch2>How many accounts were affected?\u003C\u002Fh2>\u003Cp>Strict RFC canonical email validation verified \u003Cstrong>183,999 unique valid email addresses\u003C\u002Fstrong> across the database.\u003C\u002Fp>\u003Ch2>Technical analysis and security risks\u003C\u002Fh2>\u003Cp>Salted SHA-256 password hashes remain susceptible to offline GPU-accelerated dictionary attacks. If affected individuals reused these credentials elsewhere, they face exposure to credential stuffing and account takeover risks.\u003C\u002Fp>\u003Ch2>Recommended actions for affected individuals\u003C\u002Fh2>\u003Cp>Former Stayful users who may have reused their credentials on active platforms should:\u003C\u002Fp>\u003Cul>\u003Cli>Immediately change passwords across any services where credentials matched their Stayful account.\u003C\u002Fli>\u003Cli>Activate multi-factor authentication (MFA \u002F 2FA) across personal accounts.\u003C\u002Fli>\u003C\u002Ful>","Stayful Alleged Data Exposure (184 Thousand Email Identifiers)","Stayful Alleged Data Exposure. 184 thousand email identifiers are reported. Reported data: Email addresses, Passwords, Password salts. Review the scope…","\u002Fuploads\u002Flogo\u002Fstayful.webp",false,{"name":59,"sector":60,"country":61,"website":61,"websiteArchiveUrl":61,"websiteStatus":61,"websiteCheckedAt":13},"Stayful","Hospitality","",{"success":4,"breaches":63},[64,71,78,85],{"slug":65,"title":66,"companyName":67,"logoUrl":68,"breachDate":69,"affectedCount":70,"affectedCountStatus":20},"aman","Aman 2026 Data Breach","Aman","\u002Fuploads\u002Flogo\u002Faman_com.webp","2026-04-20T00:00:00.000Z",215563,{"slug":72,"title":73,"companyName":74,"logoUrl":75,"breachDate":76,"affectedCount":77,"affectedCountStatus":20},"rci-internet-services-2026","RCI Internet Services Data Breach","RCI Internet Services, Inc.","\u002Fuploads\u002Flogo\u002Frci-internet-services.png","2026-03-19T00:00:00.000Z",40178,{"slug":79,"title":80,"companyName":81,"logoUrl":82,"breachDate":83,"affectedCount":84,"affectedCountStatus":20},"choice-hotels-international-2026","Choice Hotels Data Breach","Choice Hotels International, Inc.","\u002Fuploads\u002Flogo\u002Fchoice-hotels.svg","2026-01-14T00:00:00.000Z",24115,{"slug":86,"title":87,"companyName":88,"logoUrl":89,"breachDate":90,"affectedCount":91,"affectedCountStatus":20},"interstate-management-westin-san-diego-2025","Interstate Management Data Breach","Interstate Management Company, LLC","\u002Fuploads\u002Flogo\u002Faimbridgehospitality.png","2025-11-19T00:00:00.000Z",22743]