BigBasket under databreach exposing over 20million for free

BigBasket was lately discovered to be under a serious data breach exposing over 20 million user data on the same hacking forum, which also hosted the breached database of Facebook, LinkedIn & Clubhouse in their previous breaches. BigBasket, which is a popular online grocery store that delivers groceries over pan India, has already confirmed that it might have encountered a possible data breach months before this revelation hit the web. ShinyHunters, an infamous threat actor, was reportedly behind this alleged breach who published the database for free, claiming it to be from BigBasket.

While this isn't the first time for BigBasket as in the past, also they have been targeted multiple times. In November last year, the company confirmed in a report by Bloomberg News that there was an attempt of a data breach after 'ShinyHunter' had previously made an effort to get rid of the stolen data in private sales.

* There’s been a data breach, and we’ve filed a case with the cybercrime police, BigBasket CEO Hari Menon told Bloomberg News. The investigators have asked us not to reveal any details as it might hamper the probe.*

It came to everyone's attention after Alon Gal tweeted about this, along with a couple of samples yesterday, revealing that the database includes personal credentials such as email, phone number, address, SH1 hashed passwords, date of birth, & scores of interactions they had with the service and other assorted information.

Infamous threat actor "ShinyHunters" just leaked the database of "BigBasket, a famous Indian 🇮🇳 online grocery delivery service. (@bigbasket_com)

20,000,000+ clients affected and information such as emails, names, hashed passwords, birthdates and phone numbers were leaked. pic.twitter.com/tD5TMxNkH7
— Alon Gal (Under the Breach) (@UnderTheBreach) April 25, 2021

Although no one from BigBasket commented on this yet.

All the passwords are hashed using the SHA1 algorithm, and in the subsequent posts on the same thread, several other members claimed to have decoded over 2 million of the hashed passwords and tried selling them over. Another member claims that 700K of the users used the same string 'password' for their accounts. But ShinyHunters didn’t immediately respond to a text requesting comment.

BigBasket under databreach exposing over 20million for free

Related threat feeds

iRhythm Hackers Steal 8.2 Million Patient Records in Largest Healthcare Breach of 2026

Daxin Malware Resurfaces in Taiwan Alongside Novel Stupig Backdoor After Decade Long Silence

148 Malicious npm Packages Used to Build a Browser Based DDoS Botnet