Breach Disclosure: Zoomcar

Zoomcar, an Indian self-drive car rental company, operating in 45 cities across the country has suffered a data breach, impacting more than 3.5 million customers. This breach was put up for sale on a popular hacking forum on May 19, 2020.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

A database containing over 3.5 million records of customers of Zoomcar, an Indian self-driving car rental company, has been leaked and sold on a dark web forum for a minimal price.

Figure 1. Zoomcar’s Database available for sale on a hacker forum.

The leaked information includes:

Names
Email addresses
Phone numbers
IP addresses
Bcrypt-hashed passwords

Figure 2. Sample data posted by the threat actor selling Zoomcar’s database.