Angel One data breach: what happened and what to do

What happened

In July 2024, Angel One, an Indian stock brokerage, confirmed that data that had been leaked online was linked to a breach that happened in April 2023. Reporting at the time said the leak involved about 7.9 million customer records and that the hacker claimed to have more sensitive data that was not disclosed. Angel One said no new leak had occurred and that the breach "has no impact on client securities, funds, or credentials".

Have I Been Pwned added the data to its database in October 2026. Its entry covers 7.9 million user records containing 6,765,054 unique email addresses. The 7.9 million figure comes from press reports relayed by teiss.

Angel One was also in the news for a separate incident in 2025: it disclosed unauthorized access to data in its cloud storage after a monitoring partner flagged leaked posts in February 2025. That is a different event from the 2023 breach covered on this page.

What was exposed

Have I Been Pwned lists names, email addresses, phone numbers, physical addresses, dates of birth, bank account numbers, government issued IDs (India's Permanent Account Number, or PAN) and financial investments, meaning portfolio holdings.

What it means for you

A PAN is India's main tax identity number. Combined with a name, date of birth and address, it can be used to impersonate you with lenders, open accounts in your name, or add credibility to calls that pretend to be from a bank, a broker or a tax office. Portfolio data is unusual and valuable to fraudsters: a message that mentions the shares you actually own looks real. Expect investment scams, "KYC update" requests and fake support calls that claim to protect your account.

Bank account numbers alone don't let someone empty an account, but they help scammers build a believable pitch and attempt fraud such as fake refund or mandate requests.

How long the risk lasts

The breach dates from 2023, but leaked identity data doesn't expire. A PAN and a date of birth stay the same for life, so the same records can be reused in scams years later. Once data is copied and shared, no one can recall it. What changes over time is who has it: records that start with one seller tend to end up in larger collections that many criminals can use. That's why the sensible response is to make the data less useful, with credit checks, careful handling of OTPs and extra verification on the accounts that matter.

The company's response

Angel One has said the breach did not affect client securities, funds or credentials. Because the data dates from 2023, the practical risk is long-running scams that use your details, not an active attack on your account today.

What Serus does here

Leaked data can't be deleted from the places it circulates. Serus monitors breach databases and the dark web for your email, phone and other details and alerts you when they appear in a new leak, so you know when to take the next step.