Breach Disclosure: BigBasket

On April 25, 2020, threat actors published data obtained from the October 2020 BigBasket data breach on a cybercriminal underground forum. The data consisted of 20 million compromised records such as client names, email addresses, and hashed passwords. A BigBasket spokesperson confirms that the published dataset only contains information from the October breach.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks.
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

BigBasket, an India-based grocery delivery service, suffered a data breach in October 2020 which resulted in 20 million user credentials compromised. The ShinyHunters threat actors published a link to the breached data on a cybercriminal underground forum as well as a list of database column headers for each data type. ShinyHunters is a well-known threat actor group involved with breaching organizations and publishing stolen data on cybercriminal marketplaces.

Figure 1: Screenshot of BigBasket post by ShinyHunters

The full list of columns within the breached database were included within the post advertising the data for download.

id, created_on, updated_on, created_by_id, updated_by_id, email, password, first_name, last_name, dob, photo, is_staff,
is_active, is_superuser, last_login, registered_ip, last_logged_ip, date_joined, hub_id, address2, zipcode, location,
mobile_no, phone_no, activation_key, oac_code, news_status, about_us, address1, city, is_mapped, is_validated, area,
is_cashback_eligible, apin, pin, validated_email, validated_mobile_no, validated_address, manual_override_hub,
member_type_id, cookie_value, week_id, mapped_on, residential_complex, mapped_by_id, landmark, city_id, last_order_id,
date_of_first_order, date_of_last_order, num_of_orders, first_order_id, maximum_order_delivered_value,
total_order_orig_value, total_order_orig_num_items, total_order_delivered_num_items, total_order_invoice_value,
total_order_delivered_value, maximum_order_invoice_value, total_order_delivered_num_qty, total_order_orig_num_qty,
email_domain, credit, total_store_brand_order_value, channel, total_fv_order_value, last_fv_order_date,
last_meat_order_date, last_store_brand_order_date, total_meat_order_value, source_id, ref_id, email2,
phone_no2, password_changed_time, is_mobile_no_validated, is_email_validated

Figure 2: Full list of database columns within the breached data