HDB Financial Services hdbfs.com HDB Financial Services data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In early 2023, data on customers of India's HDB Financial Services leaked after a breach at a service provider. Have I Been Pwned counts 1.6 million unique email addresses, with names, dates of birth, phone numbers, genders, post codes and loan information.
View all 13,118 breaches- Breach date
- 22 Feb 2023
- Affected
- 1,658,750
- Data exposed
- Dates of birth, Email addresses, Genders, Geographic locations, Loan information, Names, Phone numbers
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
HDB Financial Services is a non-bank lender in India. In March 2023 it said there had been a breach at one of its service providers, one that processes some of its customer information. The company said its own systems had not been breached. Have I Been Pwned lists the incident as a leak of over 70M customer records, which contain 1.6M unique email addresses. Reporting by The Economic Times covered the company's statement.
Sources checked: haveibeenpwned.com, economictimes.indiatimes.com, consumer.ftc.gov
Last verified against the official page:
What was exposed
The records included names, email addresses, phone numbers, dates of birth, genders, post codes and loan information. No passwords are listed.
What this lets criminals do
Loan details are the part to worry about. A caller who knows you have a loan, roughly where you live and your date of birth can pose as the lender, a collections agent or a bank fraud team. They use the real details to look credible and then ask for an OTP, a card number or a transfer. Phone numbers and emails also feed ordinary spam.
What to do
Never share an OTP, PIN or full card number with anyone who contacts you, however much they seem to know about your loan. If a message about a loan or repayment arrives, contact the lender through the number on your agreement.
What to do if you were in it
- 1
Expect phishing that mentions the breach
Scammers use leaked details like your loan, phone number or date of birth to sound convincing, and the FTC warns that they may pretend to be the breached company. Don't click links in messages about it. Contact the company through a phone number or website you already know. The FTC's breach guidance explains what to look for.
- 2
Verify any call about your loan
Hang up on unexpected calls about repayments or account problems. Phone the lender back on the number from your agreement or its official site. Real lenders don't need your OTP or PIN.
- 3
Check your credit report and statements
Look for loans or accounts you don't recognize. If you find misuse, report it to your lender and your local authorities. In the US, the FTC's guidance covers freezes and fraud alerts, and other countries have equivalents.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It checks breach databases for your email, phone and other details, and Serus keeps monitoring and alerts you when they show up in a new leak. It can't remove data from a breach, so the other steps still matter.
Frequently asked
Was I affected by the HDB Financial Services breach?
Search your email on Have I Been Pwned, which lists this breach. The data concerned HDB customers, so it matters mainly if you took a loan from them.
What was exposed?
Names, email addresses, phone numbers, dates of birth, genders, post codes and loan information.
Did HDB say its own systems were breached?
No. In March 2023 the company said the breach was at a service provider that processes some customer information, and that its own systems were not breached.
Should I change my password?
Passwords aren't listed in this breach. Focus on spotting scam calls and messages that quote your loan details.
Sources
- Have I Been Pwned: HDBFinancialServices
- Have I Been Pwned: HDB Financial Services Data Breach · haveibeenpwned.com
- HDB Financial Services flags data breach at service provider · economictimes.indiatimes.com
- consumer.ftc.gov/consumer-alerts/2022/10/have-you-been-affected-data-breach-read
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- IdentityTheft.gov · identitytheft.gov
Something wrong or out of date? Tell us and we'll re-check it.
