DailyObjects Data Breach (2018): What Was Exposed & What To Do

In January 2018, a collection of more than 464,000 customer records from the Indian online retailer DailyObjects was made available online. The records contained names, email addresses, phone numbers, physical addresses and passwords. Public reporting on the incident began on 1 January 2018. DailyObjects was contacted multiple times about the data; the company eventually acknowledged receipt of a sample for verification but did not respond to further inquiries.

Breaking down the breach

The incident involved the online disclosure of customer records from DailyObjects. The reported scale is 464,000 records. The data contained names, email addresses, phone numbers, physical addresses including pincodes, and passwords. The exact date or method of the initial compromise has not been disclosed in available reports. The listing appeared in approximately January 2018.

How a breach like this happens

Incidents involving the exposure of customer databases often begin with unauthorised access to an organisation’s systems. Attackers may exploit vulnerabilities in web applications, obtain credentials through other means, or locate misconfigured storage that leaves data accessible. Once obtained, the records can be copied and posted to public sites. In many cases the organisation learns of the exposure only after the data appears outside its control.

About DailyObjects

DailyObjects is an Indian e-commerce company that sells consumer accessories and related products through its website. Like similar retailers, it collects customer information to process orders, arrange deliveries and manage accounts. A breach at such a firm can expose the personal details required for routine online purchases.

The information in question

The records reported as exposed include the following categories:

• Email addresses
• Names
• Passwords
• Phone numbers
• Physical addresses

Whether additional fields were present or whether passwords were stored in plain text remains unconfirmed beyond the initial reports.

Why it matters

Names combined with phone numbers and physical addresses can be used for targeted contact or to support further attempts at account takeover. Email addresses and passwords increase the chance that individuals will receive phishing messages or that the credentials will be tested on other sites where the same password may have been reused. For the organisation, the incident highlights the consequences of retaining customer data without confirmed safeguards.

Were you affected?

Individuals can check whether their email address appears in known breach data by using a free exposure scan service. Practical steps include changing passwords on the affected account and any other site where the same password was used, enabling multi-factor authentication where available, and monitoring bank and delivery accounts for unexpected activity.

AICompiled with AI assistance from public sources and published under our editorial standards.