Zoomcar zoomcar.com Zoomcar data breach: what happened and what to do
In July 2018, Indian car rental company Zoomcar was breached, and the data was sold on a dark web marketplace in 2020. It covers 3,589,795 accounts: names, email addresses, IP addresses, phone numbers and passwords stored as bcrypt hashes.
View all 13,115 breaches- Breach date
- Jul 2018
- Affected
- 3,589,795
- Data exposed
- Email addresses, IP addresses, Names, Passwords, Phone numbers
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Zoomcar, an Indian self-drive car rental company, was breached in July 2018. The data was sold on a dark web marketplace in 2020, and Have I Been Pwned (HIBP) added it in June 2020. HIBP counts 3,589,795 accounts, over 3.5 million records. Indian tech press reported at the time that data of 3.5 million Zoomcar customers was up for sale.
What was exposed
The data has names, email addresses, IP addresses, phone numbers and passwords. The passwords were stored as bcrypt hashes, a strong method that is slow to crack. Strong, unique passwords are unlikely to be recovered from bcrypt, but weak or common ones can be.
What's more likely to hurt is the contact data. A name, email and phone number lets someone send a convincing message about a rental booking, a deposit or a traffic fine. Phone numbers also draw spam calls and text scams.
What the company said
HIBP's entry and the Economic Times article are the sources used here for the account count and data types.
What to do if you were in it
- 1
Change your password, and every reuse of it
Change it on Zoomcar first, then on any other account that uses the same or a similar password. A password manager makes unique ones easy.
- 2
Turn on two-factor login
Use an authenticator app or passkey where you can, so a leaked password alone isn't enough to get in.
- 3
Treat booking and fine messages as suspect
Don't click links in texts or emails about rentals, deposits or fines. Open the Zoomcar app or site yourself, or call the company.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web for your email, phone and other details and alerts you when they show up in a new leak. It can't remove data that has already leaked, so the steps above are what protect you.
Frequently asked
Was I affected by the Zoomcar data breach?
Check your email on Have I Been Pwned or run a free Serus scan. HIBP lists 3,589,795 accounts.
What was exposed?
Names, email addresses, IP addresses, phone numbers and passwords stored as bcrypt hashes.
Should I change my password?
Yes, if you used a Zoomcar account, and anywhere you reused the same password.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
