Zomato Blog

Remember our #MissionGiveBack that we announced last week? That was when we introduced zero commission food orders for our restaurant partners in India.

Last month, in September, we hit a bloody-cool little milestone of 1 million reservations through our table reservations service. And that’s in just about one year of entering this space - probably making us the largest player in this space across India, UAE, Philippines, and (maybe) Australia.

Today, as part of the #MissionGiveBack, we are extending a similar benefit to all our restaurant partners across the world who accept table reservations through Zomato. Retrospectively from June 1, 2017 onward, our restaurant partners will not need to pay a “per cover” fee or even a platform fee to accept seamless digital table reservations from Zomato. Yes, the service will be completely free.

Every month, millions of users explore and visit restaurants using Zomato. With this change in fee structure, we are expecting that more restaurants start accepting online reservations from Zomato, and also not switch off their reservation slots during peak hours on weekends. Together, with our restaurant partners, we want to ensure that we put user experience at the center of everything that we do.

In the last few weeks, we’ve also upgraded our platform to make the online reservation process faster, simpler and more convenient for both diners and restaurants. And there’s a lot more coming in the next few weeks.

The table reservations service is enabled for a tad more than 10,000 restaurants in 4 countries across the world. We look forward to continue to deeply integrate with more restaurants across the countries of our presence, and bring great experiences to diners. Great user experiences will help the industry grow, and Zomato definitely grows along with the industry.

Over the past year, we have been working towards the idea of a kitchen-less world wherein most people would have access to great food and healthy meals at the same price or cheaper than the cost of preparing them at home. In the long term, we think that only hobbyists will cook at home - cooking should be something that people should want to do because it’s a joyous activity for themselves or with their loved ones, instead of it being a chore.

Of course, this is a distant dream (at least in India), but we are working on a bunch of exciting tech-led initiatives to build better accessibility to great and hygienic food for our users. In tandem we are also exploring alliances with existing players, big and small, to help surface a larger variety of healthy meal options to our users. In that spirit, we just made an investment into a startup called Tinmen - an efficient and modest little company which provides easy access to home cooked meals at affordable prices, for thousands of people in Hyderabad.

The home chefs on Tinmen use fresh ingredients and offer a variety of choices while also allowing users to choose what they would eat for lunch as well as dinner. Tinmen is already delivering over 30,000 orders a month, and we see this number steadily multiplying over the next 6 to 9 months.

Users love Tinmen - and we love them too. Zomato and Tinmen will work together (initially in Hyderabad, and then the rest of the country) to provide access to better food for more people. Through Tinmen’s unique operating model, they also generate a steady stream of revenue for their home-chefs - thereby creating earning opportunities for people who love to cook great food out of the comfort of their homes.

If you are in Hyderabad, please download the Tinmen app for Android here and iOS here. Tinmen currently serves 10 major areas in Hyderabad - Madhapur, Hitec City, Kondapur, Gachibowli, Jubilee Hills, Banjara Hills, Begumpet, Miyapur, Manikonda and Kukatpally.

First things first - Zomato is now a profitable company. Yes, throughout the 24 countries where we operate, and across all our businesses, we are starting to make money. Our core advertising business in India, Southeast Asia, and the Middle East - the three key regions for us, is generating enough cash to cover for the millions of dollars of investments we are making into the rest of the regions, and our new businesses (like online food ordering, table reservations, Zomato Gold, Zomato Base, etc.)

To mark this momentous occasion for us (and Indian tech startups in general), we want to give back to the community which has played a significant role in our journey - restaurant owners. We are rolling out a token of appreciation for restaurant owners and small business owners on our food ordering network in India. What’s that? Zero commission for all food orders placed through Zomato. To all our valuable restaurant partners - you are going to pay zero commission to Zomato if you qualify based on a set of predefined criteria. Some of these criteria include the number of orders you process with us on a weekly basis, and whether your customers are happy with your food and service. If you are in the business of providing great food and service to our customers, we want you to make more money so that you can continue to do more of the same. As per our current data, 70% of our restaurant partner base qualifies for what we are now calling “#MissionGiveBack”.

I’m very excited to share, that beginning today, you will see our team in their red Zomato t-shirts delivering food to you. We’ve been adding to our Runnr team steadily over the past week; it is already 1500 strong, and growing by the day. Just to ensure that you get your food with a smile, and on time!

Yes, that’s right, we just signed our long-rumoured acquisition of Runnr.

Emotionally, the deal has been in place for a couple of months now, and both the teams have been working closely with each other quite some time now. So much so, Mohit Kumar, the Founder & CEO of Runnr, has been living in Delhi (moving from Bangalore) for about two months already.

In May, for about a month after the first time Mohit and I spoke about potentially joining forces, he worked with the Zomato team closely to gauge whether the Runnr team would get along with ours. Zomato is an amalgam of many companies (online ordering, point of sales, infrastructure services, advertising, etc.) sharing a unified mission. The independent velocities and strengths of the different teams at Zomato gave the team at Runnr the required comfort that they would have all the levers they needed to build the business the way they always wanted to - while being aligned with a much larger mission.

Mohit also realised that Zomato's worldview included building an all-encompassing product and services platform for restaurants, and he saw exactly how Runnr could become the essential logistics company within (and beyond) Zomato. It made sense for him to go all in. For us at Zomato, we saw that we were going to be working with a team of extremely driven individuals who had figured out how to solve for a vital piece of our puzzle—the one that affects our user delight: logistics. With the combination of Zomato and Runnr, we have everything in the stack of building a delightful food delivery service in India and UAE - end to end - listings, discovery, reviews, ordering, and now, logistics.

For the record, we have always maintained that the most cost-efficient delivery fleet is the restaurant’s own, where they can utilise the same staff during off-peak hours for back-of-house and marketing activities. That belief is still intact. Keeping that in mind, Runnr will continue to function as an independent logistics company (owned by Zomato) offering the full stack of logistical services to players other than Zomato as well - e.g. pharma, grocery, e-commerce, etc. This will ensure that the delivery fleet capacity that we build operates on a positive unit economics level while serving the mega-peaks in the food delivery business.

Runnr is already efficiently fulfilling 300k orders a month - which is just a tad less than 10% of our food ordering volumes. Mohit will remain the Founder and CEO of Runnr and will continue developing his vision along with the rest of the founding team - Arpit, Mukunda, Gnanesh, Vatsal, and Aravind.

The entire team at Zomato is very eager to work with Mohit and the team, and delight our users more than we have ever been able to before. We are also excited to work towards generating meaningful employment at scale using our logistics platform. At Zomato and Runnr, the delivery boy is going to get the status of “most important employee” and is going to be treated like one.

A month or so ago, I was at a newly opened restaurant in Gurgaon and I had a chance to speak to the entrepreneur behind it. I almost never miss an opportunity to speak to restaurant owners to get their feedback on whether Zomato is helpful to their business, and to understand if we are enabling them to make the right decisions about their business.

While most of our discussion centred around product improvements, and where the restaurant industry is heading, he said something that struck a chord with me. He said, “While Zomato has helped us get a lot of new customers, it wasn’t always easy. When I had just started a few months ago, I had to almost shut down because of Zomato, until I pulled up my socks and worked my a** off to survive, and succeed.”

When I asked him to elaborate, he said that when he opened his first restaurant a few months ago, he was new to everything. So new that he had to juggle 600 things at the same time. 75% of his days were spent learning and reacting to things that he didn’t know were going to break during the day. He was the chef, the ops guy, table service guy, the delivery boy, all rolled into one - a full stack employee. And with all the teething issues, Zomato made his life very hard. He said that the online presence on Zomato is relentless and was stressful for him as a new restaurant owner. Why? Because during his first week of operations (he was of course listed on Zomato), he got 16 reviews which weren’t particularly kind to him. All because of the teething issues that he was facing. He fully believed that his restaurant wasn’t worth just the 2.9 rating that it got during the first two weeks. Proof? The restaurant is now rated a healthy 4.2 on Zomato, and has more than 500 reviews.

He didn’t get an opportunity to fully stabilise his operations early on before his restaurant’s rating started to drop. While he emphasised that the feedback was necessary for him to grow, he also argued that the penalty from a bad review could have been a death sentence, especially for a new place. We heard this sentiment echoed by other partners too. Along with trying to resolve the teething issues, this becomes a huge problem and an existential worry for entrepreneurs, as a low rating may prevent new customers from visiting the restaurant.

Since one of our core missions at Zomato has been to help restaurants achieve long term success and sustainability, we decided to do something about it.

What are we doing?

Hospitality is the most fleeting of industries. A large number of restaurants cease operations within the first few months of opening. It’s extremely disappointing for us to see this, as a lot of people work very hard to get things off the ground, and then don’t get to enjoy the fruits of their labour for very long.

Along with Skillet, which will allow us to engage more openly and directly with restaurant owners, we have been making a few changes to our product, especially for new restaurants owners and start-ups.

To make sure they navigate these early days better and more productively, new restaurants will get a “beta period” on Zomato – their overall rating will only start showing after 60 days, regardless of the reviews and ratings they receive in that time. Further, the initial few reviews gathered during that 60 day period will not count towards overall rating forever - although these reviews will remain visible on their Zomato pages.

During this phase, these restaurants will get a ‘New’ tag on Zomato to help users identify them (this will be in place of the rating tag shown against a restaurant name on Zomato). This way, restaurants will get direct, valuable feedback from their customers to fix any problems that may crop up during the very early days, without worrying about the existential concern of a low restaurant rating.

This beta period will be given to all restaurants that are new on the platform, with an important exception being chain restaurants with more than 2 outlets. Chains with 2 or more outlets are usually not expected to have teething issues based on our conversations with various industry experts. The ‘New’ label will still appear on every new restaurant page, whether it’s a part of a chain or not.

Why are we doing this?

Simply put, we understand teething issues, and we need to account for that. By introducing this “beta period”, we believe new restaurants will have a better opportunity to stabilise, plug any gaps that may appear in the early days, and build great experiences for diners in the long term.

Yes, we will keep telling you about every millionth order that we hit in a month. It means a lot to us, and we obviously can’t control our excitement.

Lao Tzu once said, “A journey of a thousand miles begins with a single step", and just like that, we took our first step towards building our online ordering business in June 2015. Today, we have hit 3 million orders for the last 31-day period. It took us 13 months to reach the first million orders a month; the second million took us 8 months, and the third million took us a little over 4 months.

Here are some important numbers for the business –

By platform, Android contributes ~51%, iPhone ~38% and Web ~11%

The share of restaurant delivered orders is ~93%

Very high customer retention - ~65% of newly signed up users for our food ordering business order again from Zomato in the next 12 months

CAC is still negligible - we are still not spending money to acquire users and our listings business is still feeding the baby

For everyone who has given Zomato Order a shot - we thank you for giving us an opportunity to serve you. It is both humbling and exhilarating for us to get a shot at building the first large global consumer internet brand, based out of India. We truly value your patronage and hope that we continue to have your loyalty and support while doing that.

Needless to say, we’re continuously trying to get better. We have a host of new features coming up in our app - and we’re excited for you to try them out.

For example, one of the smaller new features is for one of those bad days when you’re coughing and sneezing – you will soon be able to tell us that the meal you just ordered is for someone who’s a bit under the weather. And we will do everything in our power to expedite your delivery, just so that you can get your chicken clear soup ASAP.

Also, an instruction for the restaurant to not send you that plastic cutlery (we all have plenty of it lying around at home, and probably don’t need any more of it for a year).

Parting notes - if you have any feedback for us, please write to me at [email protected], or to Deepi at [email protected]. We are always striving to build a great product and ensure the best experience for all our users and restaurant partners.

For the last 9 years, we have been heavily focused on understanding our users across the globe, and in helping guide them to great dining/ ordering experiences. We have also been rapidly improving our products to keep up with constantly evolving consumer needs and trends. We currently get over 120 million visitors a month across all platforms - consuming restaurant information, referencing content generated and shared by other users, placing orders for food delivery, or making reservations at restaurants.

In the past we have also been helping the restaurant industry adapt to these changing consumer needs and trends; albeit in a fragmented and unorganized manner - through customer reviews, restaurant summits, and advanced analytics, mostly when asked for by restaurant partners.

While we have spent the last decade with a very heavy focus on helping our users discover great food, one of our core missions for the next decade is to ensure the long-term success and sustainable growth of restaurants.

This will happen by helping restaurants focus relentlessly on the right product offerings to the right consumer segments, as well as improvements in quality of food, and quality of service. These core elements will boost the ease of eating out/ordering in, and provide exponential growth to the already flourishing restaurant industry.

Zomato Skillet is one of the many initiatives we will be taking in this direction.

What is Skillet?

Skillet is an educational forum for restaurateurs, wherein we will host a series of workshops to help them identify market opportunities, discuss challenges with peers, learn from experiences of masterchefs, and address pain points in the business. Since the restaurant community is highly diverse, and each restaurant’s approach differs greatly - we are designing a range of workshops for each industry segment.

These workshops will be conducted by industry experts and successful restaurateurs. Zomato will continue to contribute our learnings from consumer behaviour, and our global exposure, back to the industry.

Skillet will be a great opportunity for us to come together, and meaningfully grow the ecosystem. We will start out by hosting the workshops across key cities in India, and then eventually take this initiative to our other countries of our presence.

Whom is it for?

These workshops will cater to restaurant owners, promoters, CXOs and F&B managers. The goal of these workshops is to provide actionable insights on various aspects of the restaurant business.

Skillet - Volume I

We’ll be kickstarting Skillet in New Delhi in August this year, and the theme for our first workshop is ‘Branching out - expansion and scaling up’. This will be relevant for restaurateurs who are looking to open their 2nd or 3rd outlets, and trying to identify the best way to do it - location, franchising, diversifying into brands, etc.

We're delighted to kick the series off with Priyank Sukhija as the speaker for our very first session. Priyank is one of Delhi's much-loved and most prolific restaurateurs, running over 25 restaurants including Tamasha, Lord of the Drinks, The Flying Saucer, Warehouse and many other successful brands. A youth icon and one of the most successful restaurateurs in the country, Priyank joins us to share his valuable insights on expansion and scaling up a restaurant business.

For more details on the event, please write to [email protected] and we’ll get back to you right away.

It’s been 45 days since we launched Zomato Treats in multiple cities, after a month-long pilot in Gurgaon. Treats is a membership program specially crafted for our users who love using Zomato Order to get food delivered home. As a Zomato Treats member you get a complimentary dessert, handcrafted by the restaurant’s chef, every time you order a meal from one of our partner restaurants in India or the UAE.

Why treats? Ever since we launched Zomato Gold for our users in the UAE and Portugal back in March, we’d been getting requests from our loyalest users in India asking what we had in store for them. While we’re lining up the launch of Zomato Gold in India soon, we wanted to start off by introducing something for our food ordering users first.

Buying a subscription in India lets you use it in Delhi NCR, Mumbai, Bangalore, Kolkata, Chennai, Pune, and Ahmedabad. Buy it in the UAE, and you can use it in either Dubai or Abu Dhabi. That’s the beauty of Treats – you can order a meal online from a partner restaurant in any of these cities, and you will receive dessert with it. These desserts are, most of the times, the most popular desserts in a restaurant’s menu.

And to sweeten the deal further, Treats is priced at just ₹299 per year in India, and 39 AED for six months in the UAE! Zomato Treats is one of those things in life which are too good to be and true.

How’s it going? Today we’re delighted to announce that we’ve hit our first milestone with over 10,000 paid subscribers for Zomato Treats, and have already served over 80,000 complimentary desserts as part of the program! From Phirni to Brownies and Oreo Shakes to Detox Juices - our 2500 partner restaurants are delighting users with sweet surprises every day :)

We have already seen a ~25% jump in order frequency for members subscribing to Zomato treats and see this trend holding over time.

Talking about sweet deals here’s what a couple of our users have to say about Zomato Treats –

Raise your hands if #zomatotreats is the best thing to happen to you! @ZomatoIN Complementary shake with sandwich 👊 pic.twitter.com/MWSGPpL450

— crazyreader_pearl (@pearl_cr)

May 20, 2017

@Zomato wonderful execution of the loyalty program.. #zomatotreats would sure help delete the other food delivery apps.

— Bharat Jhurani (@bharatjhurani)

June 24, 2017

Eeee! Finally registered for the @ZomatoIN Treats Membership 😁 can't wait for my dessert from @thaifoodhouse_ now ❤️

— Smriti Raghunandan (@famishedpanda)

June 3, 2017

Zomato Treats has also been a significant lever in driving user retention for our partner restaurants.

Here’s what some of our restaurant partners have to say about Zomato Treats -

"The response from customers using Zomato Treats has been great. We have seen a spike in orders, as well as an increase in the number of orders placed even by our existing customer base. This also gives us the chance to deliver a happy delight alongside great food to our customers." – Kaushik Roy, Biryani By Kilo (Delhi, India)

“Zomato Treats has helped us acquire new customers. Our overall business has grown over 40%. I don't think it's only about the free item, it's about people trying my food and coming back for more.” – Zuber Shaikh  Owner, Alishan Restaurant (Dubai, UAE)

"Zomato as a platform has been instrumental in generating orders for our delivery business. I would even go so far as to says it's the best food online ordering platform for us. With the launch of this new feature - Zomato Treats we have been getting a lot more visibility and have seen a huge spike in the number of orders. We have already seen a 30% growth in orders, which we really appreciate." – Sameer Gazdar, Bistro At Coffee Break. (Mumbai, India)

"Zomato Treats has turned out to be a pretty cool feature for us. We have a delicious Carrot Halwa so it's a great way for people to try our dessert. Most importantly, we saw a massive increase in frequency of orders from our customers, as well as getting new customers." – Tahir Shah (Owner), Moti Roti (Dubai, UAE)

“We’re very glad Zomato approached us with the opportunity to partner for Treats. Thanks to more visibility, we’ve been getting a lot more orders than before, and plenty of appreciation from our users. It’s a great platform for us to promote what we have to offer, and we look forward to continuing to grow with them.” – Anshu Raj, Caterspoint (Delhi, India)

As most of you know, our commitment to enhance our security practices and improve our overall infrastructure has been further strengthened in light of the recent data breach we experienced. We have since taken several critical measures to strengthen and boost our security checks. Apart from updating existing security practices and improving our overall infrastructure, we’ve also started engaging with the broader security researcher community.

Introducing our new bug bounty program

HackerOne is one of the world’s leading platforms which brings companies and security experts together. We’re excited to announce the launch of our monetary reward-based bug bounty program on HackerOne today.

The scope of the program revolves around reporting technical vulnerabilities across our products (web and mobile). The rewards for these bug reports will be based on the severity of potential vulnerability and will be assessed on a case-by-case basis by our infrastructure security team. For example, the rewards may be higher for unique and hard-to-find bugs, and relatively lower for bugs with lower risk of exploitation. The minimum reward for severe bugs like Remote Code Execution or User Personal Information Access is $1000 USD.

We would like to thank the team at HackerOne for the guidance and support they have extended to us over the last few weeks.

We also encourage security researchers to intimate us of any potential security issues. We will make every effort to quickly resolve all reported issues. To qualify for a bounty, the issue must be reported through HackerOne. More details here.

Learning from our peers and industry experts

Last year, we launched a technology-focused community initiative Huddle, with the aim of discussing the challenges the Indian tech ecosystem faces every day. The idea was to create a platform to share our combined learnings, gain feedback and perspective, and exchange ideas.

The theme for our next Huddle is “Cyber Security”. In addition to sharing our story, we have invited our peers from the Indian tech community, as well as a few industry experts to add their perspective on data security. During the event, scheduled for the 8th of July, we will deep dive into the existing and foreseeable challenges of cyber security. Stay tuned to our Engineering Blog, where we will be posting insights and learnings from this Huddle.

If you’re interested in attending the next Huddle, please register here. Since we have limited capacity, we’ll get back to you as soon as possible with a confirmation along with additional details about the event. Just in case we run out of space, and aren’t able to accommodate everyone on the 8th, we’ll make sure that we extend invitations for future Huddles to folks who miss out.

Like we previously posted on our blog here and here, a part of our infrastructure that was used to store user’s information was breached by an ethical hacker. The data downloaded as a result of this breach contained five data points for 17 million users - names, emails, numeric user IDs, usernames, and password hashes. The password hashes leak was a little more contained and impacted a subset of 6.6 million users - all the other users were using Facebook/Google for login - we don’t have any password information for those accounts.

The hacker had listed these data points on a dark web marketplace.

We were lucky we could get in touch with the person (hacker) in good time. As it turned out, the hacker was a security researcher (ethical hacker) who had put up the data for sale to get our attention (and/or to teach us a lesson). He/she only wanted us to launch a good bug bounty program on Hackerone, as he/she wanted to make sure that security researchers were rewarded well for their work. The hacker also shared the database with us and took the sales link down once we promised to launch the bug bounty program. He/she also agreed to destroy the data at their end immediately.

Since we hope no other company faces a breach like we did, we wanted to share our learnings from this incident and hope this is helpful for other growing companies.

How did the hacker get access to this data?

The hacker explained to us how he/she was able to breach our infrastructure to access a part of our database.

It all started in November 2015, when 000webhost’s user database was leaked online (with plain text passwords). One of our developers had his personal hosting account with the service. As a result of 000webhost’s user account data breach, his email address and password also became available publicly.

Unfortunately, the developer was using the same email and password combination on Github. Back then, when 000webhost passwords leaked, we were not using 2 factor authentication on Github (we have been using two-factor authentication on Github since the last few months). With the login credentials for the developer, the hacker was able to use the developer’s password to get into his Github account and review one of our code repositories to which the developer had access (this happened some time last year, but for some reason the hacker only exploited the code very recently).

Getting access to a part of the code didn’t give the hacker direct access to the database. Our systems are only accessible for a specific set of IP addresses. But the hacker was able to scan through the code, and he ended up exploiting a vulnerability in the code to access the database (via remote code execution). The piece of code which was vulnerable was a part of a deprecated system, and hadn’t been modified for a few years now.

Yes, someone has some of our code, and that’s a risk. But we have taken every step conceivable to us to make sure that the code cannot be exploited in any way possible to breach Zomato’s infrastructure. Also, one more thought that gives us comfort - with every passing day, the leaked code is getting more and more out-of-date.

While this is a case of extraordinarily bad luck, we were fortunate enough to resolve this with minimal damage. This incident taught us a good lesson on the importance of security and how we have to be paranoid about it going forward.

In hindsight, what helped us contain the extent of the breach?

Our use of multiple environments, each segregating and containing a part of business ensured that the data breach was limited to only one part of Zomato’s database; and the hacker did not gain access to all the various databases used by different businesses.

Additionally, we had made two-factor authentication on Github mandatory a few months back, which cut off the hacker’s access to the developer’s Github account for updated code. The hacker was working off an old code base - and this code base had changed significantly over the last few months, limiting the extent of data the hacker could access with the copy of the old code base.

Keeping lines of communication open with the hacker helped us understand his/her motive of the breach and address his/her (very reasonable) demands. This in turn, led to the hacker cooperating with us by pulling down the sales listing from the dark web.

We have good network restrictions in place, which ensured that our servers weren’t compromised. Which also means that our payment processing systems which run on a separate secure environment (PCI DSS Level 1 Certified) were never compromised. We have also submitted a compliance report after a detailed assessment to our payment partners - Visa Inc, and our payment gateway partners.

How did this impact the business?

We got an overwhelming amount of support from our users. Our traffic and food ordering have been holding flat or growing in the aftermath of the incident. We are thankful and extremely lucky to have a brand/product which people love and are willing to forgive for even some very big mistakes. We really hope we don’t let any of our users down anytime in the future.

What’s next?

Our team’s commitment to addressing reports for all security issues in a responsible and timely manner has become even stronger. We will continue to follow best practices and learn from the ethical hacker community to make Zomato a safer place for all users.

We are also in the process of introducing a monetary reward based bug bounty program on Hackerone very soon.

We are actively working to ensure all our systems are secure, and will also continue to invest in securing our users’ data by adopting more stringent security practices.

We are also going to invest time and effort in creating a “working group” of internet companies in India and exchange knowledge about best practices for security. We will also hold meet-ups (like the Product Huddle we conduct in Delhi NCR) so that young and large internet companies can get together and learn from each other about security.

Last thing - we have since been advised by multiple industry experts to take some action against the developer, in order to “set an example” and “influence public perception”. We know that this mishap is on the organisation, and not on an individual. Instead of pinning the responsibility on someone, we are going to use this as a learning opportunity for all of us.

Earlier today, our security team discovered that user emails and hashed passwords were stolen from our database. Since then, we have taken multiple steps to mitigate the situation. One of these steps was to open a line of communication with the hacker who had put the user data up for sale.

The hacker has been very cooperative with us. He/she wanted us to acknowledge security vulnerabilities in our system and work with the ethical hacker community to plug the gaps. His/her key request was that we run a healthy bug bounty program for security researchers.

We are introducing a bug bounty program on Hackerone very soon. With that assurance, the hacker has in turn agreed to destroy all copies of the stolen data and take the data off the dark web marketplace. The marketplace link which was being used to sell the data on the dark web is no longer available.

This incident has made our team’s commitment to addressing all our security issues in a responsible and timely manner even stronger. We look forward to working more closely with the ethical hacker community, to make Zomato a safer place for our users.

Having said that, we are going to be cautious and paranoid, as this is a sensitive matter. 6.6 million users had password hashes in the ‘leaked’ data, which can be theoretically decrypted using brute force algorithms. We will be reaching out to these users to get them to update their password on all services where they might have used the same password.

Please note that only 5 data points were exposed - user IDs, Names, Usernames, Email addresses, and Password Hashes with salt. No other information was exposed to anyone (we have a copy of the ‘leaked’ database with us). Your payment information is absolutely safe, and there’s no need to panic.

--

[Update] 60% of our users use third party OAuth services (i.e. Google and Facebook) for logging in to Zomato. We don’t have any passwords for these accounts - therefore, these users are at zero risk - both within Zomato, as well as on Google and Facebook (and any other services where the same Google/Facebook ID is being used to log in). For all our other users, as a safety measure, we strongly advise changing your passwords on other services where you might have used the same password as Zomato - we are also sending emails to such users prompting them to do the same as we speak.

-----

Over 120 million users visit Zomato every month. What binds all of these varied individuals is the desire to enjoy the best a city has to offer, in terms of food. When Zomato users trust us with their personal information, they naturally expect the information to be safeguarded. And that’s something we do diligently, without fail. We take cyber security very seriously - if you’ve been a regular at Zomato for years, you’d agree.

The reason you’re reading this blog post is because of a recent discovery by our security team - about 17 million user records from our database were stolen. The stolen information has user email addresses and hashed passwords.

We hash passwords with a one-way hashing algorithm, with multiple hashing iterations and individual salt per password. This means your password cannot be easily converted back to plain text. We however, strongly advise you to change your password for any other services where you are using the same password.

Important note - payment related information on Zomato is stored separately from this (stolen) data in a highly secure PCI Data Security Standard (DSS) compliant vault. No payment information or credit card data has been stolen/leaked.

As a precaution, we have reset the passwords for all affected users and logged them out of the app and website. Our team is actively scanning all possible breach vectors and closing any gaps in our environment. So far, it looks like an internal (human) security breach - some employee’s development account got compromised. [Update: The hacker has provided exact details of how he/she stole the data. The loophole has been plugged to prevent any further data leakage. Complete update: http://blog.zomato.com/post/160807042556/security-notice-update]

How can this stolen information be misused?

Since we have reset the passwords for all affected users and logged them out of the app and website, your zomato account is secure. Your credit card information on Zomato is fully secure, so there’s nothing to worry about there.

What next?

Over the next couple of days and weeks, we’ll be actively working to plug any more security gaps that we find in our systems.

We’ll be further enhancing security measures for all user information stored within our database

A layer of authorisation will be added for internal teams having access to this data to avoid the possibility of any human breach.

“Desserts are like a feel-good song; and the best ones make you dance.” – Chef Edward Lee

Ever since we launched Zomato Gold, our first subscription-based product for our users in the UAE and Portugal, we've been getting a lot of emails from some of our loyal users in India asking what we'll be doing for them. While we're lining up the launch of Zomato Gold in India in a couple of months, we wanted to start off by introducing something for our food ordering users in India first.

How, you might ask? With the aptly titled Zomato Treats, a subscription-based service for Zomato users in India as well as the UAE. If you live in any of the 16 cities where we offer online food delivery, a Zomato Treats subscription will get you a FREE dessert with every meal you order online on Zomato at participating restaurants.

If the child in you is jumping with joy, well, it should :-)

Furthermore, the subscription isn’t limited to a single city – you can use it if you’re ordering online in any of the 16 cities where we will eventually have Treats. Just because you aren’t home, doesn’t mean you should miss out on dessert. We’ll be rolling this out to everyone in phases over the next few weeks. Starting now, 20% of our users in Gurgaon will have the option to buy Zomato Treats and make life sweeter than before.

“It's not how much we give but how much love we put into giving.” - Mother Teresa

In the past, we’ve tried to do our bit to help the community, and the support we’ve received for our efforts from our restaurant partners and users has always been nothing short of amazing. Just over 12 months ago, we were able to accomplish this and then this in Chennai, thanks to thousands of people coming together and using Zomato to help others who were stuck in the floods. The outpouring of support we got from our users thanking us for the opportunity created by our platform to lend their support to a worthy cause, was as inspiring as it was humbling.

We pray that such things never happen again.

But all this time, we’ve been thinking about how Zomato can bring people together and help them contribute towards a common cause. The right time to drive change is when everything is running smoothly, rather than only reacting when disaster strikes.

Building on that thought, we’re setting something more enduring in motion – an ongoing initiative we’re calling ‘Turn the Tables’. Think of it as our way of bringing millions of Zomato users, our thousands of restaurant partners, and our team together with our shared love of food, to help tackle challenges that many of our friends and loved ones face in their daily lives.

The first edition of Turn the Tables is focused on a cause much of the world is working towards – helping cancer patients; more specifically, raising awareness about the disease and providing aid for cancer research. With 454.8 new cases of cancer and 171.2 deaths per 100,000 men and women each year, it's evident that fighting to find a cure for this illness is an uphill battle.

We understand the sheer magnitude of the problem, but we want to do our bit, and felt we had to start somewhere. So we reached out to restaurants across Delhi, Mumbai, and Bangalore, and – unsurprisingly – received an overwhelming response from a large number of them. And this is where our users come in. From the 7th to the 16th of April, these partner restaurants will be offering specially designed set menus. For every guest who dines in support of the cause, ₹100 will go towards our partner NGOs – Cancer Patients Aid Association (CPAA), and Karunashraya, who do excellent work providing aid and treatment to cancer patients.

“Energy and persistence conquer all things.” - Benjamin Franklin

Disclaimer : all numbers in this “short form” annual report are unaudited. Exact numbers might change in small deltas while we go through the audit.

If I have to define the last year for Zomato in just two words, these will be perseverance and focus. All of us at Zomato simply put our heads down to execute.

FY16 (ending March 2016), a year ago, wasn’t ideal for us despite having achieved 2x revenue growth over FY15. That’s because our cash burn was very high at an average of $4.2m a month.

Along with the burn rate, we were also in the middle of consolidating/ rationalising our international operations to make better use of our execution bandwidth moving forward. We had just come out of the layoffs in some of our international markets, and our team’s morale wasn’t in the best shape. Additionally, back then, we were very new to the transactions space (online food ordering) and there was a lot to learn in order to stay ahead of competition.

We believe we executed reasonably well in the last year, in spite of the hard challenges in front of us. There’s still a lot to learn. Our March 2017 revenue is $5m, helping us exit the last financial year at a $60m/year revenue run rate. We achieved $49m in revenue in FY17, a growth of ~80% over FY16.

Along with a growth in revenue, we also reduced our annual operating burn from $64m in FY ‘16 to $12m in FY’17 ($75m losses reported last year included a significant amount of non-operating burn i.e. non-cash items - depreciation, amortization and non cash provisions).

Right now, the average monthly cash burn for the period of December 2016 - March 2017 is a little less than $250k globally, down from $4.2m last March; and we’re well on our way to hit profitability.

Meanwhile, we beefed up our focus on product, engineering and traffic growth, helping our overall traffic and engagement numbers immensely. Here’s how our March 2017 traffic and engagement numbers stack up against March 2016.

All this time, while we were focused on reducing burn, and ramping up revenue, we didn’t compromise or cut down on any growth engines. In fact, the last 12 months saw the most amount of innovation coming out of Zomato. Here are a few things which happened in the last year -

Re-designing our ads model

In mid 2016, we redesigned our ad serving product to drive more value to our users as well as merchants. For starters, we stopped accepting advertising from low rated restaurants, so that our users only see the best that’s out there. The new product provided smarter targeting, simpler interface and greater visibility to our well rated advertisers. We rolled this out globally by September 2016 and helped our merchants realise a ~3x increase in value from advertising on Zomato. Our ad sales revenue grew to ~$38m in FY17.

We also further enhanced the efficacy of our sales team, which led to over 83% growth in productivity (revenue/headcount) in our ads business.

Scaling up food ordering (delivery); introducing Zomato Infrastructure Services

Our food ordering team worked simultaneously on multiple fronts - user onboarding, experience, and retention along with restaurateur experience and real time payment settlements. All these initiatives helped in further enhancing our efficiency and helped in hitting 2.1 million monthly order volume in March, while keeping our unit economics positive.

Read more about our food ordering unit economics here.

Our customer delight (support) team didn’t shy away from taking a non-orthodox approach when it came to transform hungry users to happy users, and this reflected in our average order ratings and user cohorts. Our user cohorts look quite like a ‘smile’ - which is the holy grail of user cohorts. User retention and increasing frequency is so good that even if we don’t acquire any new users in April 2017, we will still grow 8% over our March volume.

Our food ordering revenue grew to ~$9m in FY’17, 8x of FY16. We are now present in 13 cities in India, and 3 cities in UAE. Middle East is very high on adoption for Zomato, and we are preparing for launching food ordering in Beirut, the Paris of Middle East.

The above wouldn’t have been possible without the cooperation of our restaurateur network. Our team worked closely with our merchants and resolved the recurring issues on ground, resulting in very low order rejections, more timely deliveries and, consequently, higher order ratings.

We also launched our first cloud kitchen in Delhi NCR which can potentially give a huge boost to our online food ordering business. You can read more about that here.

Introducing Table Reservations

On the back of our increased user engagement levels, we launched Table reservations product in July 2016, and became the market leaders in India and UAE within a month of launch. Currently we have the table reservation option across 24,000 restaurants in 12 cities. In the month of March, we seated 600k guests via our table reservations product.

Read how we grew in our table reservations business in our blog post - “The real value of discount-based customer acquisition strategy”.

Launching Zomato Gold

We also launched a premium membership programme, Zomato Gold, in Lisbon and Dubai in March 2017. The willingness of restaurants to get on board, and the whopping response from users assures us we are on the right track, and see a long, fulfilling journey ahead.

Read the blog post for launch of Zomato Gold in Dubai and Lisbon.

Beta-testing Zomato Base

Our Point of Sale product is finally starting to take shape, and is undergoing paid beta trials at over ~200 restaurants of various types and sizes. The upcoming year should definitely see increased adoption of Zomato Base by restaurants across India, UAE and beyond.

–

Over the last year, the composition of our senior leadership team has evolved for the better, and we have been able to successfully integrate some new people into key roles within the organisation. For example, Mukund Kulashekaran is leading our food ordering business, Gaurav Gupta is leading our Table Reservations business. Samir Kuckreja is leading Zomato Base. We also very recently welcomed our new President and COO, Deepak Gulati (ex-CEO Tata Docomo) to Zomato.

–

Overall, we are in a good place now. The team is hungry for moonshots, and is keeping its head down, learning and executing well. Of course, there’s always a lot more ahead of us and we all truly believe that we are only 1% done.

Stay tuned for an upcoming blog post by Deepinder - “Learnings from 2016”. We realised Deepinder is never going to get around to writing this, so please don't stay tuned!

“Sometimes, it’s the journey that teaches you a lot about your destination.” - Anonymous

In the summer of 2015, when we were preparing to launch online food ordering services in India, we had more questions than answers. Yes we had a blueprint in place, and a dedicated team that enjoys tough challenges, but we were still… what’s the word… hungry? Hungry to learn and know more. Until we stepped into the river, we wouldn’t know how cold it was. At the same time, we knew we were capable of achieving what we were setting out to achieve. Since then, we’ve managed to meet expectations in a lot of ways.

In the month of March (2017), with a little more than a day to go, we have processed 2m online food orders through Zomato.

The journey from 1m orders to 2m orders was a hard one, and we learnt a lot about what matters and what doesn’t. Here are some of the ways we got here - 

Better customer retention - a million small things, which ended up compounding towards the current milestone.

Maniacal focus on customer support. We introduced a new “motto” for our customer support team - “every meal matters”. Since then, the customer support team has been very proactive about every single order that goes through Zomato, and our users are loving us even more than before.

Effective and faster customer acquisition at negligible cost (our marketing budget for food ordering still hovers around $50k per month).

We increased the restaurant supply available on Zomato from 12,000 restaurants a few months ago to 18,000 today.

Here are some more numbers which might interest you –

March will grow ~23%+ over February

By platform, Android contributes ~48%, iPhone ~36% and Web ~16%

Average order value is ~INR 430 for India and ~AED 62 for UAE

The share of restaurant-delivered orders is close to 90%

Average delivery time is approximately 38 minutes

Average commission rates of ~8.5% (for restaurant-delivered orders)

Unit economics are very positive and our net margins on an order are ~55%

Online food ordering contributes ~20% revenue to our overall topline

We have a great team building our food ordering business. This milestone is a testimony to the quality, focus, and persistence of our team here.

Which brings us to the most important part - our users and restaurateur partners who make everything possible. Without the former’s trust in us, there would be no reason to better ourselves. Without the latter’s belief in us, there would be no variety to look forward to. I take this opportunity to wholeheartedly thank everyone for their unwavering faith in us.

Lastly, there are many more millions to come. We are now the leading food ordering platform in India and UAE. We are also the largest food search/discovery platform in 13 countries outside of India. It is humbling for us to have a shot at building the first truly global consumer internet brand, born and brought up in India. With your continuing love and feedback, we will get there very soon.

There are so many different reasons to look forward to an evening drink. Very often, you’re itching to head out with your friends because there’s something big to celebrate!

If you’ve ever had to second-guess a night out on the town, we’ll make sure you never have to again. After all, why think twice, when you can drink twice?

We’re very proud to present our newest product offering in the UAE, to help make night out decisions a lot easier for you and for your pocket – Zomato Gold. It’s been just a week since we soft launched Zomato Gold in Dubai, and the initial response we have seen from our users has been staggering.

But first, what is Zomato Gold?

Quite simply, it is a membership program for a premium nightlife experience in the cities of Dubai and Abu Dhabi –

It lets you enjoy up to two rounds of 1+1 on any beverage at many top restaurants, bars and lounges.

You can enjoy Gold benefits any time and on any day of the week. Happy hours just got that much longer.

Users can buy a 3-month, a 6-month, or a 12-month membership plan. The introductory prices right now start at as low as AED 99

There are more than 200 premium Gold partners (restaurants, bars and lounges) to choose from, located in popular areas such as JLT, Barsha, DIFC, Downtown Dubai, Trade Centre, Deira, and pretty much all over Dubai and Abu Dhabi.

A single membership plan for Dubai and Abu Dhabi.

We have made sure that there’s a Gold partner within 3 kilometers of anywhere in Dubai or Abu Dhabi.

Your membership will let you visit any of the Gold partner restaurants that you like on any given day/time, and you can visit each partner more than once.

What we personally love about Gold is how much you end up saving. The 1+1 benefit can get you 4 drinks for the price of 2 at any of our partners on a single visit, and thus double the value. We also love the fact that Gold is applicable even during peak hours on weekends.

To check out Zomato Gold, download/open the Zomato app, change your location to Dubai (if you aren’t already there), and look out for the “Introducing Zomato Gold” banner on your home screen.

What makes Gold special?

Unlike any other similar product out there, we focused very heavily on making Gold the most extensive and convenient dining membership program out there.

Zomato Gold has the widest possible range of partner restaurants, bars and lounges – 200+ so far, and we’re going to keep adding to them.

We made sure that most of these places are the top-rated places on Zomato

There’s no restriction on the drinks you can order with your membership. The entire drinks menu is yours to choose from.

Gold is ultra convenient to use - there’s no need to punch in anything on your phone or scan QR codes. Just one tap on the partner restaurant’s page on the Zomato app, and you are all set.

If you live in Dubai, or travel there often, we hope this product appeals to you. We look forward to you becoming a member. Open your Zomato app to do just that.

When will Zomato Gold arrive in other cities?

Gold will arrive in Delhi, Mumbai and Bangalore somewhere around June. We will decide launch dates for other international cities depending on what we learn over the next few weeks/months. Our Melbourne, Jo’burg, and Istanbul teams are waiting eagerly to launch Zomato Gold in their cities 🙇🏼 .

Any questions?

Please email [email protected]

PS

If you use Zomato Gold for alcoholic drinks, please drink responsibly, and don’t be a jerk.