Dunzo Data Breach (2020): What Was Exposed & What To Do

What happened

According to the available records, the Dunzo incident occurred around June 2019. On 19 June 2020 the breach was added to Have I Been Pwned after the data set was supplied by dehashed.com. The material had already been posted on a hacking forum and contained 3.5 million unique email addresses along with associated fields.

Public reporting does not include a technical description of how the data left Dunzo’s systems. The scale of the exposure, the date of the original compromise, and the types of information listed are the only Reported Details at present.

How a breach like this happens

Incidents that result in customer records appearing on forums often begin with unauthorised access to an organisation’s database or backup storage. Attackers may exploit an unpatched server, obtain valid credentials, or use other entry points that allow them to copy files without immediate detection.

Once data is removed, it can be shared or sold on closed forums. The presence of the Dunzo records on such a forum indicates that the material circulated beyond the initial point of access, though the exact sequence of events remains undisclosed.

Dunzo and its sector

Dunzo operates a delivery platform in India that connects customers with local stores and couriers. Services of this type routinely collect names, contact details, device identifiers and location information to arrange pick-ups and deliveries.

Because these platforms process orders in real time, they accumulate data sets that include both persistent identifiers and transient location records. A breach at one such service therefore exposes information that can be linked across multiple accounts or services.

What was likely exposed

The records reported in connection with the Dunzo breach include device information, email addresses, geographic locations, IP addresses, names and phone numbers. These categories match the types of data a delivery service would normally store to fulfil orders.

Whether every record contained all listed fields, or whether additional categories were present, has not been confirmed in public statements. The precise contents of the data set therefore remain unverified beyond the fields already noted.

The real-world impact

Individuals whose details appeared in the data set may receive unsolicited messages or see their contact information used in attempts to gain access to other accounts. Phone numbers and email addresses are frequently reused across services, which can extend the reach of any follow-on activity.

For the organisation, the incident adds to the body of known exposures affecting delivery platforms. It does not, on its own, demonstrate systemic failure, but it illustrates the consequences when large volumes of customer data are obtained and circulated.

Were you affected?

Anyone who used Dunzo before mid-2019 can check whether their email address appears in the reported data set by using a free exposure scan offered by Have I Been Pwned or similar services. Changing passwords on Dunzo and any other accounts that share the same email or phone number is a prudent first step.

Monitoring for unusual account activity and enabling multi-factor authentication on services that support it can reduce the chance that exposed contact details are used successfully. No further official notification process has been described in the available reporting.

AICompiled with AI assistance from public sources and published under our editorial standards.