Upstox data breach: 111K accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2022-01-19
In April 2021, Indian brokerage firm Upstox suffered a data breach. The incident exposed extensive personal information on over 100k customers including names, genders, dates of birth, physical addresses, banking information and passwords stored as bcrypt hashes. Extensive "know your customer" information was also exposed including scans of bank statements, cheques and identity documents complete with Aadhaar numbers. Exposed data: bank account numbers, dates of birth, email addresses, family members' names, genders, government issued ids, income levels, marital statuses, nationalities, occupations, passwords, phone numbers, physical addresses. The breach dates from Apr 8, 2021; Have I Been Pwned loaded it on Jan 19, 2022.
What to do
- If you had a Upstox account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
