SafetyDetectives Cybersecurity Team
Published on: December 16, 2022

The SafetyDetectives cybersecurity team has discovered a leaked SQL database appearing to belong to the RedAwning vacation platform.

A user on the forum posted the database for free, which is now available for the public to view. According to our researchers, the database is exceptionally well-organized and easy to search. So, our researchers were able to ascertain that the alleged data breach likely impacts approximately 45,000 registered users.

Who is RedAwning?

RedAwning.com is an online travel agency that enables tourists to find and book vacation properties worldwide. Founded in 2010, the California-based organization provides marketing, distribution, reservation, and hospitality solutions to customers in the United States.

The company uses the slogan, “Travel boldly, we’ve got you covered” and claims to be “the largest branded collection of vacation properties in the world offering hotel-like reservation and support services.”

According to the organization, its partners include Airbnb, Booking.com, Expedia, Trivago, and Agoda. RedAwning recently acquired Lexicon Travel Technologies, a US channel manager.

What is the forum about?

The website where the database was found is a forum available on the clear, surface web. The community forum includes tutorials for crack tools, exploits, and software.

Forum members are able to post and promote database leaks. There is also a marketplace for purchasing digital products and services, including cracked accounts, fraudulent tokens, and credit card dumps.

Screenshot of the forum’s landing page

Exposed information:

The likely date of the breach was on or around September 6, 2018. We base this assumption on our analysis of recorded timestamps contained in the database. In order to determine an exact date of breach, we would have to comb through the entire exposed SQL database but we chose not to for ethical reasons.

The forum post is dated November 10, 2022, and was published by a forum member. SafetyDetectives discovered the forum post containing details about the data breach on November 16.

Screenshot of the forum post

The forum post reads:

“RedAwning is the world’s largest branded global network of vacation rental properties providing connectivity to all major online travel websites with complete 24/7 marketing and reservation services.

Compromised data: Email addresses, Geographic locations, Names, Phone numbers, Physical addresses, Reservations

The .7z File’s MD5 Hash is 519783c9cdd95a9280c61fc8d074ad8c. In total, there are ~170,000 user records. The file is 3.33GB uncompressed and 212MB compressed.”

The database was said to contain 3.3GB of uncompressed data, containing 28,658,749 records, including Personally Identifiable Information (PII) such as names, phone numbers, and physical addresses. Based on further analysis, our researchers estimate that in total, there appears to be at least 87,000 further, unregistered users included in the records.

SafetyDetectives researchers estimate that 45,000 registered users are included in the leak of the 3.3GB SQL database.

Considering the size of RedAwning, said to have served close to one million customers to date, it is unclear if the leak only included a small portion of RedAwning’s overall database, or if the users referred to are property owners rather than holidaymakers.

The impact of the data breach:

At this time, it is not possible to say how long the SQL database was exposed or if the database continues to be open and accessible today.

The data dump appears to include the Personally Identifiable Information (PII) of RedAwning users, including their first names, last names, cities of residence, email addresses, hashed passwords, booking dates, and cell phone numbers.

Screenshot of a SQL table exposing RedAwning users

Screenshot showing the table’s users columns

Screenshot of the SQL table showing table names

The exposed data would have been enough for skilled cybercriminals to commit many of the most common forms of fraud or online attacks against allegedly compromised RedAwning users, including:

• Identity theft
• Phishing campaigns
• Doxing and harassment

Timeline:

• September 6, 2018: The likely date of the alleged data breach
• November 10, 2022: The link to the SQL database was posted online
• November 16, 2022: The data dump was found by SafetyDetectives

We have reached out to the database owners, but have yet to receive a response as of today.

Preventing data exposure:

When third parties hold your data, unfortunately, it is out of your hands when an organization exposes information. Here are some preventative tips and guidance on what happens after you are made aware of a data breach.

• Be cautious of what information you give out and to whom
• Check that the website you’re on is secure by looking for HTTPS in the address bar, and/or a closed lock). This shows that communication has at least a basic level of encryption. It would help if you also used a VPN to disguise and secure your online activity.
• Only reveal online what you feel confident cannot be used against you. Avoid sharing or posting sensitive PII, images, or personal preferences that could be troublesome if made public.
• Create secure passwords by combining letters, numbers, and symbols, and consider using a password locker to store complex combinations securely.
• Do not click links or respond to emails unless you know the sender is legitimate. Fraudulent links can send you to malicious websites or expose you to exploit kits, whereas phishing emails are designed to steal your information.
• Double-check any social media accounts (even ones you no longer use) to ensure that the privacy of your posts and personal details are visible only to people you trust.
• Avoid using credit card information and typing out passwords over unsecured WiFi networks.

You can use tools including HaveIBeenPwned, as well as read our research and keep an eye on the news to find out if you are potentially involved in a data security incident.

If you suspect your data has been leaked, don’t panic. Nevertheless, it would be best if you tried contacting the organization responsible to discover exactly what happened. Furthermore, you should keep an eye on your credit report and your financial accounts for any signs of suspicious activity indicative of identity theft or fraud.

About us:

SafetyDetectives tests, compares, and reviews antivirus software, password managers, parental control apps, and virtual private networks (VPNs) using a robust testing methodology.

The SafetyDetectives research lab is a pro bono service that aims to help the online community defend itself against cyber threats. We aim to help the online community defend itself against modern-day cyberattackers while educating organizations on how to protect their users’ data.

Find out more about what constitutes cybercrime, the best tips to prevent phishing attacks, and how to avoid ransomware by following SafetyDetectives’ blog and our latest news.