What Happened
In February 2026, Mad Monkey Hostels, a leading Southeast Asia-based hostel operator, suffered a data breach claimed by threat actor “@888,” resulting in the exposure of approximately 16,000 customer records. The compromised data included customer IDs, email addresses, MAD levels, Firebase UIDs, last sign-in dates, week start and end dates, and sign-in counts within the week, as evidenced by leaked samples showing real user emails like “antoniodougherty98@gmail.com” and timestamps from October 2025. The database was publicly posted for download on underground forums like Spear.cx by March 31, 2026, with tracking confirming the actor’s involvement around March 12, 2026. No official company statement or further details on the breach method or remediation appear in available sources.
