PropTiger Data Breach (2018): What Was Exposed & What To Do

In January 2018, the Indian property platform PropTiger suffered a data breach that exposed a 3.46GB database file containing records linked to roughly 2.2 million users. The file included more than 2 million unique email addresses along with associated personal details and login histories; it later circulated on a hacking forum. The incident became public knowledge when the data surfaced two years after the breach occurred. PropTiger stated at the time that the practical value of the exposed material was limited because of the way certain fields had been generated and stored.

Breaking down the breach

The breach itself took place in January 2018. A single database file of 3.46GB was taken from PropTiger systems and later posted on a popular hacking forum. The file contained both user account records and login histories. Public reporting at the time identified 2.2 million affected individuals and more than 2 million distinct email addresses. No further technical details about the initial intrusion method or the precise date of access have been disclosed.

How a breach like this happens

Incidents involving the exposure of customer databases often begin with an attacker obtaining access to an organisation’s servers or backup storage. This can occur through unpatched software, stolen administrative credentials, or misconfigured access controls that leave data reachable from the public internet. Once inside, an attacker may copy entire tables rather than targeting specific records. The resulting files are sometimes held privately for a period before appearing on forums or marketplaces, which delays public awareness of the event.

Who is PropTiger?

PropTiger operates as an online real-estate marketplace in India, connecting property buyers and sellers and providing listing and search services. Companies in this sector routinely collect account information from users who register to view listings, receive alerts, or contact agents. Such platforms therefore hold contact details, demographic fields, and authentication data that support account management and marketing functions.

What was likely exposed

The published facts list the following categories of information in the exposed file: names, email addresses, dates of birth, genders, IP addresses, device information, and passwords stored as MD5 hashes. The database also contained login histories. PropTiger indicated that the usability of some attributes was reduced by the manner in which they had been created or stored, but the company did not publish a full inventory of every field present in the 3.46GB file.

The real-world impact

Individuals whose email addresses and hashed passwords appeared in the data face the possibility that attackers will attempt to match the hashes against known password lists. Where users have reused passwords across services, this can lead to unauthorised account access elsewhere. Dates of birth, names, and genders can support identity-verification attempts or targeted phishing. IP addresses and device information may allow correlation of activity across accounts but do not, by themselves, enable direct financial transactions. For the organisation, the incident adds to a record of past security events and may prompt increased scrutiny from users and regulators regarding data-handling practices.

Were you affected?

Anyone who created an account on PropTiger before or during 2018 can treat their information as potentially exposed. A practical first step is to change the password on that account and on any other service where the same password was used. Enabling multi-factor authentication where available adds further protection. Readers can also run a free exposure scan of their email address against known breach data sets to check for appearances in this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.