Breach Disclosure: IndiaMART

Breach Disclosure: IndiaMART

In August 2021, IndiaMART, an India-based e-commerce company, was the subject of a data breach that resulted in the compromise of over 38 million records. The data was discovered when a threat actor opened a thread on a cybercriminal underground forum advertising a breach package containing over 20 million unique credentials for IndiaMART. Information obtained from the breach package includes unique email addresses, names, phone numbers, and physical addresses.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Review network logs for potential signs of compromise and data egress.
• Enforce administrative or application control restrictions to prevent unauthorized installation of software or media.

Details

On August 21, 2021, actor "globetrotters" posted a data breach package targeting the organization IndiaMART on a cybercriminal underground forum. The actor specifies that the package contains 40 million records, and of those records approximately 20 million unique email addresses. The actor also claims that the post contains data that has been circulating in other cybercriminals networks for over a year. From this package, ZeroFox extracted 20,167,754 email addresses. No passwords were found in this breach. Other notable data fields observed in this package include: physical address, mobile number, and customer profile details.

In a thread observed in May 2021, an actor using the alias "osintguy" advertised the sale of a breach package containing 41 million compromised records allegedly for IndiaMART. The post contains a list of extracted database columns, as well as an attachment containing a sample of the data from the package. The actor requests buyers to contact them via their Telegram handle to purchase the breach package.

Figure 1. Actor "osintguy" advertises sale of alleged IndiaMART breach package

IndiaMART is a business-to-business (B2B) company that connects Indian manufacturers with buyers. The company issued a statement about the incident and denied any data leak or breach. They further clarified that the supposed information within the breach package (sellers' names, email addresses, phone numbers, and physical addresses) are publicly available via the IndiaMART website, and that sellers' personally identifiable information is not exposed on the portal. Although it is unclear how the data was exposed, some possibilities include intentional exposure and scraping, or retrieval via a software vulnerability.