> ## Content Index > Fetch the complete content index at: https://darkwebinformer.com/llms.txt > Use this file to discover other available public pages before exploring further. # Alleged Breach of Alyna Exposes 18,000 Users With Passwords, GPS Coordinates, and Booking Data From Kuwaiti Laundry and Cleaning App - URL: https://darkwebinformer.com/alleged-breach-of-alyna-exposes-18-000-users-with-passwords-gps-coordinates-and-booking-data-from-kuwaiti-laundry-and-cleaning-app/ - Published: 2026-03-25T16:02:55.000Z - Updated: 2026-03-25T16:02:55.000Z - Author: Dark Web Informer - Tags: Data Breaches Dark Web Informer - Cyber Threat Intelligence # Alleged Breach of Alyna Exposes 18,000 Users With Passwords, GPS Coordinates, and Booking Data From Kuwaiti Laundry and Cleaning App March 25, 2026 - 10:07:11 AM UTC Kuwait Services / Mobile App Standalone API Access Now Available High-volume threat-intelligence data, automated ingestion endpoints, ransomware feeds, IOC data, and more. [ View API](https://darkwebinformer.com/api-details/) Unlock Exclusive Cyber Threat Intelligence Powered by DarkWebInformer.com Stay ahead of cyber threats with real-time breach tracking, expert analysis, and high quality evidence - built for security professionals, researchers, journalists, and everyday people who take their privacy seriously. [ Subscribe Now](https://darkwebinformer.com/pricing) ## Quick Facts Date & Time 2026-03-25 10:07:11 UTC Threat Actor Sorb Victim Alyna Industry Services / Mobile App Category Data Breach Total Users 18,000 Unique Emails 13,500 Unique Phones 16,000 Password Hashing MD5 Price $300 Network Open Web Country Kuwait ## Incident Overview A threat actor going by Sorb claims to be selling the full user database from Alyna, a Kuwait-based mobile app that provides laundry and cleaning services. The company was founded in 2019 in Hawally, Kuwait, and operates as an unfunded app-based platform available on both Google Play and the Apple App Store. The database contains 18,000 total user records with the following data points: - **Account Data**: User IDs, account types, names (including Arabic names), gender, date of birth, email addresses, mobile numbers, profile images, registration dates, and email verification status. - **Credentials**: Passwords hashed with MD5, which is a weak and easily crackable hashing algorithm. The actor also mentions a combo list of email/phone hash pairs (13,500 mail hashes and 17,000 phone hashes). - **Location Data**: GPS coordinates (latitude and longitude), booking addresses, street addresses, and area information. This is particularly sensitive as it reveals where users live or regularly request services. - **Device and Platform Data**: Operating system type, device language, push registration IDs, and social media registration source. - **Service Data**: Preferred services, house type IDs, room counts, booking details, likes, guest status, and anonymization flags. - **Tokens**: Kfast tokens that may allow session hijacking or unauthorized account access. The listing is priced at $300 with escrow available, and the actor specifies this is a single-buyer exclusive sale ("sales in one hands"). The deduplicated counts show 13,500 unique emails and 16,000 unique phone numbers. Given the nature of the service, the GPS and booking address data effectively maps where users live across Kuwait, making this a physical safety concern beyond typical PII exposure. ## Compromised Data Categories Full Names (English & Arabic) Email Addresses Phone Numbers MD5 Hashed Passwords GPS Coordinates (Lat/Lon) Booking & Street Addresses Date of Birth Gender Device & OS Information Social Media Registration Service Preferences Kfast Tokens ## Image Preview [![Forum post by Sorb selling 18,000 user records from Alyna Kuwait laundry app with company description and app store links](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2026/03/33824268418131185249.png)](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2026/03/33824268418131185249.png) [![Database field structure and record counts for Alyna breach showing CSV column headers including GPS coordinates, passwords, and booking data](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2026/03/33824268418131185250.png)](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2026/03/33824268418131185250.png) ## Claim URL Subscriber Access Required The original listing URL and unredacted claim images are available on the Threat Feed and Ransomware Feed for paid subscribers. [ Subscribe](https://darkwebinformer.com/pricing) Subscriber Access View the original listing URL and unredacted claim images on the feeds below. [ Threat Feed](https://darkwebinformer.com/threat-feed/) [ Ransomware Feed](https://darkwebinformer.com/ransomware-feed) ## MITRE ATT&CK Mapping [ T1190 Exploit Public-Facing Application Targets vulnerabilities in the mobile app's backend API or web infrastructure to gain unauthorized access to the user database. ](https://attack.mitre.org/techniques/T1190/) [ T1555 Credentials from Password Stores Extracts MD5 hashed passwords from the database. MD5 is a weak algorithm that can be cracked rapidly, giving attackers access to plaintext credentials for account takeover. ](https://attack.mitre.org/techniques/T1555/) [ T1213 Data from Information Repositories Extracts structured user data from the app's backend database including personal profiles, service preferences, booking histories, and location records. ](https://attack.mitre.org/techniques/T1213/) [ T1589.002 Gather Victim Identity: Email Addresses Harvests 13,500 unique email addresses and 16,000 phone numbers along with associated personal details for resale or targeted attacks. ](https://attack.mitre.org/techniques/T1589/002/) [ T1528 Steal Application Access Token Extracts Kfast tokens and push registration IDs that could be used to hijack user sessions or send unauthorized push notifications to victims' devices. ](https://attack.mitre.org/techniques/T1528/) [ T1567 Exfiltration Over Web Service Advertises and sells the stolen database through web forums as an exclusive single-buyer deal with escrow service for $300. ](https://attack.mitre.org/techniques/T1567/) Dark Web Informer © 2026 | Cyber Threat Intelligence [DarkWebInformer.com](https://darkwebinformer.com/)