A cybercriminal has leaked about 20 million files, said to belong to BigBasket users , containing personal information and hashed passwords. BigBasket is a popular Indian online grocery delivery service that allows people to shop online and have products delivered to their homes.
See also: Nokia faces data breach allegations
Yesterday, a well-known seller of compromised data, known as ShinyHunters, posted for free a database that was said to have been stolen from BigBasket.
In November 2020, BigBasket confirmed to Bloomberg News that the company had suffered a data breach, after hacking group ShinyHunter had previously attempted to sell the stolen data.
“There was a data breach and we have informed the police cybercrime department,” BigBasket CEO Hari Menon Bloomberg News. “The investigators have asked us not to disclose details as it may hamper the investigation.”
See also: Apple sues former employee for leaking trade secrets to the media
The ShinyHunters hacking group often starts by selling data and then releasing it for free. This is what happened with the BigBasket database, which reportedly contains more than 20 million user records.
The database includes information such as: email, SHA1 hashed passwords, home addresses, phone numbers, and other personal information.
The exposed passwords are hashed with the SHA1 algorithm, and members of the hacking forum claim to have already cracked 2 million of these passwords. Another member claims that around 700 thousand BigBasket customers were using the password “password” for their accounts.
See also: User files of 26 companies sold on hacking forum
The ShinyHunters group has also been linked to other data breaches, including Tokopedia, TeeSpring, Minted, Chatbooks, Dave, Promo, Mathway, Wattpad, and many more.
What should BigBasket customers do?
BleepingComputer has confirmed that some of the exposed files are accurate. Therefore, customers of the Indian company should not be reassured. They should consider their data to have been leaked and take protective measures.
All BigBasket users must change their passwords on BigBasket and on any other site where the same password is used.
Source: Bleeping Computer
