BigBasket faces data breach, details of over 2 crore users put on sale on dark web

BigBasket has filed a police complaint with the Bengaluru Cyber Crime Cell to verify claims of a potential data breach affecting 2 crore users made by cyber intelligence firm Cyble.

Cyble has claimed that a hacker has put data allegedly belonging to BigBasket on sale for around Rs 30 lakh on dark web.

"In the course of our routine dark web monitoring, the research team at Cyble found the database of BigBasket for sale in a cybercrime market, being sold for over $40,000. The leak contains a database portion; with the table name 'member_member'. The size of the SQL file is about 15 GB, containing close to 20 million user data," Cyble said in its blog.

Tata Group eyes minority stake in BigBasket: Reports.

Cyble added that the data put on sale include names, email IDs, password hashes, contact numbers (mobile and phone), addresses, date of birth, location, and IP addresses of login among many others.

While Cyble has mentioned "passwords", the company uses a one-time password sent through SMS which keeps on changing with every login.

Stating the privacy and confidentiality of customers is priority, BigBasket said it does not store any financial data including credit card numbers etc and is confident that this financial data is secure.

"A few days ago, we learnt about a potential data breach at BigBasket and are evaluating the extent of the breach and authenticity of the claim in consultation with cybersecurity experts and finding immediate ways to contain it. We have also lodged a complaint with the Cyber Crime Cell in Bengaluru and intend to pursue this vigorously to bring the culprits to book," it said in a statement.

The cyber intelligence firm had claimed that the breach occurred on October 30, 2020, and it has already informed the management of BigBasket about it.

The Bengaluru-based grocery e-commerce platform BigBasket is funded by Alibaba Group, Mirae Asset-Naver Asia Growth Fund, and the UK government-owned CDC group.

(With inputs from agencies)