A database of over 20 million users of BigBasket, an online grocery delivery service, has allegedly been leaked on a cybercrime forum. This announcement came months after the grocery delivery company faced a massive data breach.

The leaked database includes phone numbers, email addresses, birth dates, addresses, scrambled passwords, and other information of the users. The details of a few customers listed in the database, including that of the author, have reportedly been confirmed.

People with knowledge of the matter have reportedly cited that the leaked records are from an alleged data breach that happened in November 2020, as the article or social media post mentioned the release of the hashed passwords. BigBasket has eliminated all these hashed passwords from the system as well as shifted to a secure OTP-based authentication mechanism. The company further stated that its site does not store or collect any sensitive personal information such as credit card details to ensure high data safety of the customers.

Sources further revealed that the grocery delivery startup had confirmed the data breach that happened previously, which compromised the information of 20 million users from the platform. A hacking group known as ShinyHunters had published the alleged database of the BigBasket users and recently made it available on a well-known cybercrime forum for download.

According to the new posts on the hacker forum, at least 2 threat actors had claimed to have decoded the customers’ hashed passwords & put them up for sale. ShinyHunters did not immediately respond to requests for comments on the recent publication of the users’ database.

The incident happened along the heels of the settlement of an acquisition deal between BigBasket and Tata Group, an Indian conglomerate company, valuating the startup at nearly $1.8 billion. The deal is apparently awaiting the approval of the Indian regulator.

Source credit:

https://techcrunch.com/2021/04/25/hacker-publishes-alleged-records-of-20-million-bigbasket-users/