Chowbus Data Breach (2020): What Was Exposed & What To Do

In October 2020, the Asian food delivery app Chowbus experienced a data breach that resulted in more than 800,000 records being sent by email to customers. The message included a link to a CSV file containing customer details, among them over 444,000 unique email addresses together with names, phone numbers and physical addresses. The incident was reported on 5 October 2020 and is understood to have affected approximately 444,000 people.

Breaking down the breach

The available information states that customer records were distributed via email to Chowbus users themselves. The email contained a link to a CSV file holding the exposed data. No further details on the initial point of compromise, the duration of unauthorised access, or the precise technical method have been disclosed. The reported scale is limited to the figures above; no additional records or subsequent leaks have been confirmed in the available reporting.

How a breach like this happens

Incidents involving the distribution of customer files often begin with unauthorised access to an internal system or database that stores user information. Once access is obtained, an attacker may locate and export records in bulk, after which the data can be forwarded through ordinary channels such as email. In many cases the precise entry point remains undisclosed, leaving open questions about whether credentials were obtained, a misconfiguration was exploited, or another vector was used. Without a public technical report, the sequence remains general rather than specific to this event.

Chowbus and its sector

Chowbus operates as a food-delivery platform focused on Asian cuisine, connecting customers with restaurants through a mobile application. Services of this type routinely collect and retain contact details and delivery addresses to fulfil orders. A breach at such a company is consequential because the data supports routine transactions yet, once exposed, can be retained indefinitely by unknown parties and combined with other available information.

The information in question

The records described in the reporting include email addresses, names, phone numbers and physical addresses. The exact contents of the CSV file beyond these categories have not been confirmed publicly. Organisations in the food-delivery sector commonly hold additional fields such as order histories or payment tokens, but it is not known whether those fields were present in the exposed file.

Why it matters

Physical addresses paired with names and contact details can be used for targeted unsolicited contact or to support more elaborate impersonation attempts. Email addresses and phone numbers increase the volume of potential phishing or spam. For the organisation, the incident highlights the operational risk of storing large volumes of identifiable customer data in a form that can be exported and distributed in a single file. No financial losses or regulatory penalties have been stated in the available information.

What to do if you're exposed

Individuals who believe their information may have been included can begin by monitoring their email and phone for unexpected messages and by reviewing delivery addresses on file with any services they use. Enabling two-factor authentication on accounts that accept it reduces the value of exposed contact details for account takeover. A free exposure scan of an email address against known breach data sets can indicate whether the address has appeared in other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.