bigbasket bigbasket.com bigbasket data breach: what happened and what to do
bigbasket, an Indian grocery platform, had a breach in October 2020 that exposed over 20 million customer records (24,500,011 accounts in Have I Been Pwned). Names, emails, phone numbers, addresses, dates of birth, IP addresses and password hashes were exposed.
View all 13,115 breaches- Breach date
- 14 Oct 2020
- Affected
- 24,500,011
- Data exposed
- Dates of birth, Email addresses, IP addresses, Names, Passwords, Phone numbers, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
bigbasket is an Indian online grocery platform. Have I Been Pwned lists 24,500,011 accounts from a breach it dates to October 14, 2020.
What happened
In November 2020, cyber intelligence firm Cyble reported that a database of close to 20 million bigbasket users was for sale online, for over $40,000. bigbasket acknowledged a potential breach, filed a complaint with the Cyber Crime Cell in Bengaluru, and said it doesn't store financial data such as card numbers. The data was leaked publicly in April 2021.
What was exposed
Email addresses, IP addresses, physical addresses, names, phone numbers, dates of birth and passwords stored as Django SHA-1 hashes. SHA-1 is an older, fast hashing method, so weak passwords can be cracked from the hashes.
What that means for you
Name, phone number and home address is what a scammer needs for a fake delivery or refund call. A date of birth adds identity theft risk. Anyone who cracks your password can try it on other accounts. Because the data was first sold and then published, assume it is still being passed around, and treat unexpected calls or messages that know your details with caution.
What to do if you were in it
- 1
Change your bigbasket password and anywhere you reused it
The passwords were stored as Django SHA-1 hashes, which attackers can crack, especially weak ones. Pick a new, unique password for bigbasket and for any other account that shared it. A password manager makes that painless.
- 2
Turn on two-factor authentication
Use an authenticator app or a passkey on your email, banking and shopping accounts. A leaked password then isn't enough to log in.
- 3
Expect phishing that mentions bigbasket
Names, emails and phone numbers let scammers write believable messages. Treat unexpected emails and texts that mention bigbasket or your orders with suspicion, and go to the site directly instead of clicking links.
- 4
Be wary of calls and texts about deliveries or refunds
Scammers use grocery order details for fake delivery problems. Don't share OTPs or approve payments for anyone who contacts you, and use the app or site directly.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your data appears, so you hear about the next one early. It can't remove data from a breach, so the alert is the useful part.
Frequently asked
Was I affected by the bigbasket breach?
Check your email on Have I Been Pwned, which lists 24,500,011 accounts.
Were my card details exposed?
bigbasket said it doesn't store financial data such as card numbers. The exposed data lists no payment cards.
What was exposed?
Names, email addresses, phone numbers, physical and IP addresses, dates of birth and password hashes.
Should I change my password?
Yes, and change it anywhere you reused it.
Sources
- Have I Been Pwned: bigbasket
- haveibeenpwned.com/Breach/bigbasket
- outlookindia.com/national/india-news-bigbasket-faces-potential-data-breach-details-of-2-crore-users-feared-to-be-on-dark-web-news-363873
- medianama.com/2020/11/223-bigbasket-data-breach/
- indianexpress.com/article/business/business-others/bigbasket-data-breach-user-details-leaked-dark-web-cyber-crime-7009578/
Something wrong or out of date? Tell us and we'll re-check it.
