DavaIndia Security Lapse Exposed Sensitive Data via Unauthenticated API

The vulnerabilities inherent in rapidly digitizing sectors, a significant security lapse at DavaIndia Pharmacy, one of India's largest and fastest-growing pharmacy chains, recently exposed sensitive customer data and granted external actors potential "super admin" control over its core systems. The incident, first reported by TechCrunch, underscores the acute risks when backend administrative interfaces—the digital keys to the kingdom—are left unguarded.

Unauthenticated "Super Admin" API

The flaw was uncovered by security researcher Eaton Zveare, who identified a critical vulnerability rooted in the pharmacy chain's implementation of its administrative Application Programming Interfaces (APIs) . Specifically, these "super admin" APIs were found to be insecure, meaning they did not require any form of user authentication or authorization for access.

Aspect of Vulnerability	Technical Description & Impact
Root Cause	Insecure, unauthenticated "super admin" APIs on the DavaIndia website.
Exploitation Method	An unauthenticated user could directly interact with these APIs to create new accounts with the highest level of platform privileges.
Resulting Access Level	Full "super admin" control, granting the ability to modify backend settings, view all data, and alter core business logic.

With this level of access, a malicious actor would not merely be a guest; they would be an omnipotent administrator. The vulnerability stemmed not from a complex injection attack, but from a fundamental oversight in access control—a failure to ensure that the interfaces designed for internal management were not exposed and accessible to the public internet without proper checks.

Scope of Exposure: Data, Controls, and Scale

The access potentially granted a window into the operations of a significant portion of DavaIndia's network. According to Zveare's findings shared with Indian cybersecurity authorities (CERT-In), the exposed systems provided oversight of 883 stores. The exposure is understood to have revealed approximately 17,000 online orders, a dataset that, while potentially a snapshot, was highly sensitive in nature.

The exposed data and controls can be categorized as follows:

Sensitive Customer Information (PII & Health Data)

The core of the exposure involved Personally Identifiable Information (PII) inextricably linked to health-related purchases. For each exposed order, a malicious actor could view:

Full Name
Phone Numbers
Email Addresses
Mailing Addresses
Total Amount Paid
Products Purchased (e.g., specific medications, health supplements, or personal care items).

As Zveare noted, the pharmacy context heightens the sensitivity: "the products being purchased could be considered private and even embarrassing for some people." This confluence of identity and health data creates a potent privacy risk, potentially revealing diagnoses, chronic conditions, or other sensitive health details.

Administrative and Operational Control

Beyond data theft, the "super admin" access enabled an attacker to manipulate the platform's core functions. This represents a significant integrity and availability risk:

Modification of Product Listings & Pricing: An attacker could deface the website, alter prices, or remove products, causing commercial disruption and reputational damage.
Control of Prescription Rules: Critically, the flaw allowed changes to settings governing whether certain medicines required a prescription. An attacker could, in theory, disable prescription checks, facilitating the illegal sale of restricted drugs.
Creation of Discount Coupons: This could be used for financial fraud or to incentivize specific, potentially harmful, purchases.
Website Content Edits: The ability to alter content could be leveraged for phishing, misinformation, or simply to undermine customer trust.

Timeline and Response

The timeline of events, as reported, raises questions about the speed of coordinated disclosure and remediation.

Late 2024: System timestamps indicated the vulnerable administrative interfaces had been live since this period.
August 2025: Security researcher Eaton Zveare discovered the flaw and responsibly reported it to CERT-In (Indian Computer Emergency Response Team), the national agency for cyber security incidents.
Weeks Later: Zveare reported that the vulnerability was technically fixed within weeks of his report.
Late November 2025: Official confirmation from Zota Healthcare (DavaIndia's parent company) regarding the fix was provided to CERT-In.
January 2026: Zota Healthcare publicly announced the opening of 276 new DavaIndia stores, part of a massive expansion plan adding 1,200-1,500 outlets over two years.
February 13, 2026: TechCrunch published its exclusive report on the incident.

Importantly, the researcher stated that there was no evidence the flaw was exploited maliciously before it was patched. However, the duration for which the systems were exposed (potentially nearly a year) remains a point of concern.

Digital Healthcare Ecosystem Exposed

API Security is Patient Safety: In the digital health domain, cybersecurity is not just an IT issue; it is a patient safety issue. The potential to alter prescription requirements transforms a data breach into a direct threat to public health.
The Perils of Rapid Scaling: Zota Healthcare's aggressive expansion, while a sign of business growth, may have outpaced its ability to secure its underlying digital infrastructure. New stores mean a larger, more complex digital footprint, increasing the attack surface.
Regulatory Scrutiny and Accountability: The incident will inevitably invite scrutiny under India's Digital Personal Data Protection Act, 2023. As a "data fiduciary," DavaIndia is responsible for implementing reasonable security safeguards to prevent personal data breaches. The exposure of sensitive health data could lead to significant penalties if investigations find negligence.
The Critical Role of Researchers: The discovery and reporting of this flaw by an independent researcher highlight the indispensable role the security research community plays in protecting digital infrastructure. Responsible disclosure mechanisms, like reporting to CERT-In, are vital for coordinated vulnerability management.

DavaIndia data exposure is a potent illustration of how foundational security lapses—like an unauthenticated API—can compromise the entire digital operations of a major enterprise. For a company entrusted with some of the most private information about individuals, the failure represents a serious lapse in fiduciary duty. While the prompt fix prevented known malicious exploitation, the incident will likely have lasting consequences for customer trust and regulatory compliance as India's digital health sector continues its rapid evolution.

DavaIndia Security Lapse Exposed Sensitive Data via Unauthenticated API

Related threat feeds

Daxin Malware Resurfaces in Taiwan Alongside Novel Stupig Backdoor After Decade Long Silence

Unauthenticated "Super Admin" API

Scope of Exposure: Data, Controls, and Scale

Timeline and Response

Digital Healthcare Ecosystem Exposed

148 Malicious npm Packages Used to Build a Browser Based DDoS Botnet

Pakistan Law Enforcement Agencies Targeted in Alleged Multi Group Cyber Espionage Operations