Massive data breach at BigBasket exposes data of over 20 million users

According to Cyble, the leaked database contains data of close to 20 million users. It contains full names, email IDs, password hashes (potentially hashed OTPs), pin, contact numbers (mobile + phone), full addresses, date of birth, location, and IP addresses of login among many others.

India's leading online supermarket BigBasket has allegedly suffered a massive data breach and the leaked data has been put on sale on the dark web for over USD 40,000 (approx. Rs 30,00,000), according to US-based global cybersecuirty firm Cyble.

Cyble claimed that the data breach occurred on October 14, 2020 and it was detected on October 30. BigBasket management has already been informed about the alleged breach and they are currently working towards a disclosure process.

According to Cyble, the leaked database contains data of close to 20 million users. It contains full names, email IDs, password hashes (potentially hashed OTPs), pin, contact numbers (mobile + phone), full addresses, date of birth, location, and IP addresses of login among many others.

"In the course of our routine Dark web monitoring, the Research team at Cyble found the database of Big Basket for sale in a cyber-crime market, being sold for over $40,000. The leak contains a database portion; with the table name 'member_member'. The size of the SQL file is ~ 15 GB, containing close to 20 Million user data," Cyble wrote in an official blog post.

Funded by Alibaba Group, Mirae Asset-Naver Asia Growth Fund, and the UK government-owned CDC Group, BigBasket serves in leading Indian cities including Bangalore, Hyderabad, Mumbai, Pune, Chennai, Delhi, Noida, Mysore, Coimbatore, Vijayawada-Guntur, Kolkata, Ahmedabad-Gandhinagar, Lucknow-Kanpur, Gurgaon, Vadodara, Visakhapatnam, Surat, Nagpur, Patna, Indore and Chandigarh Tricity.

The Bengaluru-based company is reportedly evaluating the extent of the breach and authenticity of the claim in consultation with cybersecurity experts and has also lodged a complaint with the Cyber Crime Cell in Bengaluru.