IndiaMART data breach: 20.2M accounts exposed
Severity: medium · Patch status: no-fix-needed · Since 2021-08-27
In August 2021, 38 million records from Indian e-commerce company IndiaMART were found being traded on a popular hacking forum. Dated several months earlier, the data included over 20 million unique email addresses alongside names, phone numbers and physical addresses. It's unclear whether IndiaMART intentionally exposed the data attributes as part of the intended design of the platform or whether the data was obtained by exploiting a vulnerability in the service. Exposed data: email addresses, names, phone numbers, physical addresses. The breach dates from May 23, 2021; Have I Been Pwned loaded it on Aug 27, 2021.
What to do
- If you had a IndiaMART account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
