Moneycontrol data breach: 762K accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2021-05-22
In April 2021, hackers posted data for sale originating from the online Indian financial platform, Moneycontrol. The data included 763 thousand unique email addresses (allegedly a subset of a larger 40 million account breach), alongside geographic locations, phone numbers, genders, dates of birth and plain text passwords. The date of the original breach is unclear, although the breached data indicates the file was created in September 2017 and Moneycontrol has stated that the breach is "an old data set". Exposed data: email addresses, genders, geographic locations, passwords, phone numbers. The breach dates from Sep 7, 2017; Have I Been Pwned loaded it on May 22, 2021.
What to do
- If you had a Moneycontrol account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
