2017 — Zomato: Hacker used developer's compromised…
Data compromised
Names, emails, user IDs, usernames, password hashes
Technical writeup
May 2017. Hacker used developer's compromised 000webhost/GitHub credentials; exploited deprecated code for RCE and database access. Stolen: names, emails, user IDs, usernames, password hashes (6.6M). Payment data in separate PCI vault—not compromised. Ethical hacker listed data for $1k; removed after Zomato launched bug bounty.
Root cause
Compromised developer credentials; deprecated code vulnerability.