bigbasket Data Breach (2020): What Was Exposed & What To Do

In October 2020, the Indian online grocery platform bigbasket experienced a data breach that exposed records belonging to 24.5 million customers. The incident was reported on 14 October 2020. The data later appeared on public leak sites in April 2021 after having first been offered for sale. The breach involved names, email addresses, phone numbers, dates of birth, physical addresses, IP addresses, and passwords stored as Django SHA-1 hashes. No further technical details on the method of intrusion or the precise timeline of access have been disclosed in public reporting.

What happened

Public records indicate that bigbasket suffered unauthorised access to customer information in 2020. The breach was first noted in October of that year, with an estimated 24.5 million records affected. The material was subsequently sold and then released publicly in April 2021.

The disclosed data fields include names, email addresses, phone numbers, dates of birth, physical addresses, IP addresses, and passwords stored as Django SHA-1 hashes. No information has been released about how the initial access occurred or whether the intrusion was detected internally before external reporting.

How a breach like this happens

Incidents involving large volumes of customer records from online retail platforms commonly result from unauthorised access to databases that store account and order information. Attackers may exploit vulnerabilities in web applications, misconfigured cloud storage, or compromised credentials to reach these systems.

Once obtained, the data is frequently packaged and offered for sale on underground forums before appearing on public leak sites. Passwords hashed with older or single-round algorithms such as SHA-1 can be processed offline if the hashes themselves are obtained.

bigbasket and its sector

bigbasket operates as a major online grocery retailer in India, handling customer accounts, delivery addresses, and payment-related details for millions of users. Platforms of this type routinely collect names, contact information, dates of birth, and IP addresses to manage orders and deliveries.

A breach at a service with this scale and data profile is consequential because the records can be used for targeted account takeover attempts, phishing campaigns, or further criminal activity that combines multiple data points from the same individuals.

What was likely exposed

The reported data types include names, email addresses, phone numbers, dates of birth, physical addresses, IP addresses, and passwords stored as Django SHA-1 hashes. These fields were confirmed in connection with the 24.5 million records.

Organisations in this sector also typically hold order histories and payment metadata, but it has not been confirmed whether those additional categories were included in the exposed material.

What's at stake

For individuals, the exposure of contact details alongside physical addresses and hashed passwords increases the chance of receiving targeted phishing messages or attempts to access other accounts that reuse the same credentials. Hashed passwords require additional effort to use, yet older hashing methods remain susceptible to offline processing.

For the organisation, the incident adds to the record of retail-sector breaches and may prompt regulatory scrutiny or customer remediation costs, though the long-term operational impact has not been quantified in available reports.

If your data was in this breach

Individuals can begin by changing passwords on bigbasket and any other sites where the same credentials may have been used. Enabling multi-factor authentication on accounts that support it reduces the value of a leaked password.

Readers can run a free exposure scan of their email address against known breach data to determine whether their information appears in this or other documented incidents. Monitoring financial accounts and remaining alert to unsolicited messages that reference personal details can further limit potential harm.

AICompiled with AI assistance from public sources and published under our editorial standards.