BigBasket has filed a police complaint in Bengaluru after a potential data breach was reported on the grocery e-commerce website, exposing personal details of around 2 crore users. Cyber intelligence firm Cyble said that a hacker has put data allegedly belonging to BigBasket on sale for around Rs 30 lakh.
Cyble said in the blog that the research team has found the database of BigBasket for sale in a cyber crime market, being sold for over USD 40,000. “The leak contains a database portion; with the table name 'member_member'. The size of the SQL file is about 15 GB, containing close to 20 million user data," Cyble said in its blog.
The leaked data includes full names, email IDs, password hashes (potentially hashed OTPs), pin, contact numbers (mobile + phone), full addresses, date of birth, location, and IP addresses of login among many others, the firm said.
Cyble added that based upon the leaked records, it appears the breach took place on October 14 and that it detected the breach on October 30. The firm then notified BigBasket, which has now filed a police complaint. According to PTI, BigBasket has issued a statement confirming the same.
"A few days ago, we learnt about a potential data breach at bigbasket and are evaluating the extent of the breach and authenticity of the claim in consultation with cybersecurity experts and finding immediate ways to contain it. We have also lodged a complaint with the Cyber Crime Cell in Bengaluru and intend to pursue this vigorously to bring the culprits to book," the Bengaluru-based company said in a statement.
The company added it does not store any financial data of customers and is confident that their financial data is secure.
BigBasket currently provides services in Bengaluru, Hyderabad, Mumbai, Pune, Chennai, Delhi, Noida, Mysore, Coimbatore, Vijayawada-Guntur, Kolkata, Ahmedabad-Gandhinagar, Lucknow-Kanpur, Gurgaon, Vadodara, Visakhapatnam, Surat, Nagpur, Patna, Indore and Chandigarh Tricity city. The company is funded by Alibaba Group, Mirae Asset-Naver Asia Growth Fund, and the UK government-owned CDC group.