> ## Content Index
> Fetch the complete content index at: https://darkwebinformer.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Roomer Travel Account Data on More Than 200,000 Users Shared on a Forum
- URL: https://darkwebinformer.com/roomer-travel-account-data-on-more-than-200-000-users-shared-on-a-forum/
- Published: 2026-08-27T18:27:01.000Z
- Updated: 2026-08-27T18:27:01.000Z
- Author: Dark Web Informer
- Tags: Data Breaches

Breach Report Travel Marketplace Shared Free No Passwords in Sample 

## Roomer Travel Account Data on More Than 200,000 Users Shared on a Forum

A forum actor posting as **slvsh3r** has published what they describe as the client database of **Roomer Travel**, a marketplace and mobile app for buying and reselling non refundable hotel reservations. The post claims **more than 200,000 records** and the sample shows account identifiers, first and last names, usernames, email addresses, verification flags, currency preferences and referral codes. Fields for **phone number, postal address, credit balance and payout configuration are present in the schema but empty in every visible row**, and no password field appears at all. The files are unlocked for a nominal forum fee. The claim is **unverified**.

Severity MODERATE 

[ ![WhiteIntel, dark web exposure monitoring](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2026/08/whiteintel_io_banner.jpg) ](https://whiteintel.io/?utm%5Fsource=darkwebinformer.com&utm%5Fmedium=referral&utm%5Fcampaign=whiteintel) 

Records claimed200,000+

EmailsPresent

Payment fieldsEmpty

Actorslvsh3r

### ▣Post details

TargetRoomer Travel

CountryNot stated

SectorTravel marketplace

ListingForum points to unlock

Volume200,000+ claimed

Stated sourceNot described

ObservedAug 27, 2026

Actorslvsh3r

### !What the post claims

- More than 200,000 records
- Account identifiers
- First and last names
- Usernames
- Email addresses
- Account verified flags
- Currency preference
- Referral codes
- Credit balance fields
- Payout configuration fields
- Stripe enabled flag
- PayPal account field
- Address fields present but empty
- Phone fields present but empty
- Profile photo field
- No password field in sample
- Automated or test accounts visible
- Sequential identifiers

### ◱Screenshot

[ ![Forum post publishing account data attributed to the travel marketplace Roomer, August 2026](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/size/w1304/format/webp/2026/08/2978056728635798623597862398756978235.png) Screenshot 1 Redacted preview ](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/size/w1304/format/webp/2026/08/2978056728635798623597862398756978235.png) 

Forum post publishing Roomer Travel account data, observed 27 August 2026.

### ☷Mapped techniques

The post describes no intrusion method. Both entries are inferred from the artefacts, not stated.

- Collection [T1213](https://attack.mitre.org/techniques/T1213/) Data from information repositories Inferred Records appear as nested objects with sequential identifiers and empty optional branches, which reads as a serialised export from an application rather than a scrape of profile pages.
- Exfiltration [T1567](https://attack.mitre.org/techniques/T1567/) Exfiltration over web service Inferred Distribution runs through forum hosting behind a points wall. The route out of the environment is not described.

### ⚠Potential impact

This is a **thin set by the standards of what it advertises**. Strip out the empty branches and what remains is a name, a username and an email address per account, with no passwords, no addresses, no phone numbers and no payment identifiers populated anywhere in the sample. As a privacy matter that is limited. Where it has value is **context**: everyone in this file is a user of a marketplace for reselling hotel bookings that cannot be refunded, which means a good proportion of them have **either lost money on a trip or are trying to recover some of it**. That is an unusually receptive audience for refund and rebooking fraud, and a message referencing a real account, a real username and the correct platform will clear the first bar of suspicion for many of them. Two things deserve checking against the full file rather than the sample. Whether the **payout fields are populated anywhere**, since a PayPal address tied to a named seller is a materially different exposure, and whether **address and phone are filled for the subset who completed transactions**, which is where a partial export would show its seams.

### iStatus Unverified

The sample carries **one detail that argues for authenticity**: several records contain machine generated gibberish in the name fields, the sort of automated or test account that accumulates in any real production table and that someone fabricating a file would have no reason to invent. Identifiers also run **sequentially in a narrow band well above the claimed record count**, which is consistent with a slice of a larger table rather than a complete export, and sits awkwardly with the headline figure. Set against that, **no intrusion method, date or access route is given**, the volume cannot be checked from what is shown, and the near total absence of populated optional fields means the set may be far less complete than the count suggests. The account is **established, with a purchased forum rank**. Dark Web Informer has **not retrieved the file and is not linking it**, nor the archive credentials. Roomer Travel has not publicly addressed the claim.

Want everything on this breach? **Paid subscribers** get the full unredacted claim details and more. After subscribing, check out the [threat feed](https://darkwebinformer.com/threat-feed/?utm%5Fsource=alert&utm%5Fmedium=card&utm%5Fcampaign=roomer-travel-2026-08-27&utm%5Fcontent=threat-feed) and search there for this alert.

[View pricing →](https://darkwebinformer.com/pricing?utm%5Fsource=alert&utm%5Fmedium=card&utm%5Fcampaign=roomer-travel-2026-08-27&utm%5Fcontent=pricing-button) 

[Dark Web Informer](https://darkwebinformer.com/?utm%5Fsource=alert&utm%5Fmedium=card&utm%5Fcampaign=roomer-travel-2026-08-27&utm%5Fcontent=footer) // Threat Intelligence