Zoomcar data breach: what leaked and what to do
Zoomcar (zoomcar.com) had a data breach on 2018-07-01 affecting 3,589,795 accounts. Passwords were involved.
!Passwords leaked
Added to the catalogue 5 June 2020.
What leaked
- Email addresses
- IP addresses
- Names
- Passwords
- Phone numbers
What happened
In July 2018, the Indian self-drive car rental company Zoomcar suffered a data breach which was subsequently sold on a dark web marketplace in 2020. The breach exposed over 3.5M records including names, email and IP addresses, phone numbers and passwords stored as bcrypt hashes. The data was provided to HIBP by dehashed.com.
Description from Have I Been Pwned, in its words.
What to do
- Change the password on that service, and anywhere you used the same password. A password manager makes this painless.
- Turn on two-factor sign-in on that service and on your email.
- Warn staff: emails, texts or calls quoting leaked details are not proof the sender is genuine.
- If card or bank details leaked, watch statements and tell the bank; if identity documents leaked, consider a credit ban or alert.
Common questions
What leaked in the Zoomcar breach?
Email addresses, IP addresses, Names, Passwords, Phone numbers
When did the Zoomcar breach happen?
The breach date is 2018-07-01; it was added to the public catalogue on 2020-06-05.
What should I do if my staff used this service?
Change the password there and anywhere it was reused, turn on two-factor sign-in, and warn staff about emails quoting the leaked details.
Was a staff address in this breach?
Check one address free, no storage. Breach Watch checks every staff address after each new breach.