Bookchor Data Breach (2021): What Was Exposed & What To Do

In January 2021, the Indian book trading website Bookchor suffered a data breach that exposed records belonging to 498,000 customers. The incident came to light on January 28, 2021, after the data appeared on a hacking forum. The exposed information included names, email addresses, phone numbers, dates of birth, genders, IP addresses, social media profiles, and passwords stored as unsalted MD5 hashes.

Breaking down the breach

The breach affected roughly half a million customer records from Bookchor, an online platform for trading books. Public reporting on the incident states that the data set contained email and IP addresses along with names, genders, dates of birth, phone numbers, and passwords hashed with unsalted MD5. The same data was later observed being traded on a hacking forum. No further details on the method of access, the exact date of the intrusion, or the total volume of files have been disclosed in available reports.

How a breach like this happens

Incidents involving the exposure of customer account data often begin with an attacker gaining access to a web application or database through unpatched software, weak authentication controls, or compromised credentials. Once inside, the attacker can copy tables that store user profiles and login information. Passwords stored with unsalted MD5 hashes are particularly susceptible to offline cracking because the algorithm is fast and provides no additional protection against precomputed lookup tables. After extraction, the data may be packaged and offered for sale or exchange on forums that specialize in such material.

Bookchor and its sector

Bookchor operates as an online marketplace focused on the purchase and sale of new and used books, primarily serving customers in India. Platforms of this type maintain accounts that link personal details to transaction histories, shipping addresses, and payment preferences. A breach at such a service is consequential because the records typically combine contact information with identifiers that can be used to link individuals across other online services.

The information in question

The records reported as exposed include dates of birth, email addresses, genders, IP addresses, names, passwords, phone numbers, and social media profiles. Passwords were stored as unsalted MD5 hashes. The precise contents of the data set have not been independently verified beyond the descriptions provided in breach reports, so the full scope of any additional fields remains unconfirmed.

What's at stake

For individuals, the release of names, phone numbers, and dates of birth alongside email addresses can facilitate targeted phishing or account takeover attempts on other sites where the same credentials or similar personal details are reused. Hashed passwords, even when weak, may be cracked and tested against additional services. For the organization, the incident creates operational costs related to notification, remediation, and potential regulatory scrutiny under Indian data protection requirements.

Were you affected?

Individuals who created an account on Bookchor can review the service’s own notifications for guidance on resetting passwords and monitoring account activity. Changing passwords on Bookchor and any other sites that share the same credentials is a practical first step. Running a free exposure scan of your email address against known breach data sets can indicate whether your information has appeared in this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.