E-commerce platform faces a potential data breach; user records available on the dark web

guest · Nov 8, 2020

BigBasket faces potential data breach; details of 20 mn users put on sale
Names, email IDs, password hashes, contact numbers, addresses of users put on sale on dark web, claims cyberintelligence firm Cyble
November 5, 2020
https://www.business-standard.com/a...-million-customers-hacked-120110800800_1.html

Online grocery platform BigBasket has become the latest target of cyberattack in India.
The company has faced a potential data breach with the information of over 20 million customers on the darkweb for sale, according to US-based cybersecurity intelligence firm Cyble.

The data, being sold for $40,000, includes the full names, email IDs, password hashes (potentially hashed OTPs), PIN, contact numbers, addresses, dates of birth, location, and IP addresses of login, among other bits of information, says a Cyble blogpost.
Click to expand...

“The privacy and confidentiality of our customers are our priority and we do not store any financial data, including credit card numbers, and are confident that this financial data is secure,” said the Alibaba-backed company in a statement.
According to the Cyble blogpost, the alleged breach occurred on October 14 and the BigBasket management was informed about it on November 1.
Click to expand...

Cyble: BigBasket, India's leading online supermarket shopping, allegedly breached. Personal details of over 20 million people sold in darkweb

Recently, Big Basket, India’s leading online food and grocery store, became victim to a data breach.

This Bengaluru-based company, funded by Alibaba Group, Mirae Asset-Naver Asia Growth Fund, and the UK government-owned CDC group, has a valuation of around $2 billion, providing services to consumers to choose from over 18,000 products from over 1000 brands to be delivered at their doorstep.
Click to expand...

guest · Nov 15, 2020

mood said: ↑

BigBasket faces potential data breach; details of 20 mn users put on sale
Cyble: BigBasket, India's leading online supermarket shopping, allegedly breached. Personal details of over 20 million people sold in darkweb
Click to expand...

[UPDATE-2]

Update on November 15 – It has been brought to our attention that BigBasket has filed an First Information Report (FIR) on November 6, 2020, with the cyber cell of the Bengaluru Police to investigate the incident — a day before Cyble had made public, the details of the breach.

Ironically, it appears that the complaint has made against Cyble itself – who was the informant of the breach aka “shooting the messenger”. We have updated the timeline with more information to avoid any ambiguity, which malicious-intent or paid reporters might take advantage of.
Though Cyble has not received any communication from any of the concerned authorities at this stage, it is still necessary to put forth the truth and clarify a few things here – [...]
Click to expand...

guest · Apr 25, 2021

Hacker leaks 20 million alleged BigBasket user records for free
April 25, 2021
https://www.bleepingcomputer.com/ne...lion-alleged-bigbasket-user-records-for-free/

A threat actor has leaked approximately 20 million BigBasket user records containing personal information and hashed passwords on a popular hacking forum.

This morning, a well-known seller of data breaches known as ShinyHunters posted a database for free on a hacker forum that he claims was stolen from BigBasket.
As is typical for older breaches privately sold by ShinyHunters, the threat actor has now released the whole database for free, which reportedly contains more than 20 million user records.

Infamous threat actor ShinyHunters just leaked the database of BigBasket, a famous Indian online grocery delivery service. (@bigbasket_com)
20,000,000+ clients affected and information such as emails, names, hashed passwords, birthdates and phone numbers were leaked. pic.twitter.com/tD5TMxNkH7
— Alon Gal (Under the Breach) (@UnderTheBreach) April 25, 2021
Click to expand...

The passwords are hashed using the SHA1 algorithm, and forum members have claimed to crack 2 million of the listed passwords already. Another member claims that 700k of the customers used the password 'password' for their accounts.
Click to expand...

Log in or Sign up

E-commerce platform faces a potential data breach; user records available on the dark web

guest Guest

guest Guest

guest Guest

Log in or Sign up

E-commerce platform faces a potential data breach; user records available on the dark web

guest Guest

guest Guest

guest Guest

Useful Searches