Royal Enfield data breach: 420K accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2022-03-31
In January 2020, motorcycle maker Royal Enfield left a database publicly exposed that resulted in the inadvertent publication of over 400k customers. The impacted data included email and physical addresses, names, motorcycle information, social media profiles, passwords, and other personal information. Exposed data: dates of birth, email addresses, genders, names, passwords, phone numbers, physical addresses, social media profiles, vehicle details. The breach dates from Jan 1, 2019; Have I Been Pwned loaded it on Mar 31, 2022.
What to do
- If you had a Royal Enfield account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
