Zoomcar Data Breach (2018): What Was Exposed & What To Do

Data breaches affecting millions of customer records from mobility and rental platforms remain a persistent feature of the current threat landscape, often coming to light long after the initial compromise and sometimes resurfacing on underground markets years later. In the case of Zoomcar, records indicate that a breach first associated with the company in 2018 exposed information belonging to approximately 3.6 million individuals, with the data later appearing for sale in 2020.

What happened

Public records show that Zoomcar, an Indian self-drive car rental company, experienced a data breach in 2018. The incident was reported on 1 July 2018 and involved more than 3.5 million records. The data subsequently appeared on a dark web marketplace in 2020 and was later provided to Have I Been Pwned by dehashed.com. No further technical details about the intrusion method or exact timeline of discovery have been disclosed in available reporting.

How a breach like this happens

Incidents involving the exposure of customer databases from online service providers commonly result from unauthorised access to inadequately protected systems or third-party infrastructure. Attackers may exploit vulnerabilities in web applications, misconfigured databases, or stolen credentials to extract large volumes of stored information. Once obtained, such datasets are sometimes held privately before being offered for sale on underground forums, allowing the same records to circulate over extended periods.

Zoomcar and its sector

Zoomcar operates in the self-drive car rental sector in India, providing vehicles to customers through a digital platform that requires registration and payment details. Companies in this industry routinely collect and retain personal identifiers, contact information, and account credentials to manage bookings, verify users, and process transactions. A breach at such a firm can therefore affect a broad customer base whose data remains useful for secondary misuse long after the rental relationship ends.

What data was at risk

The records associated with the incident included email addresses, IP addresses, names, phone numbers, and passwords stored as bcrypt hashes. The exact scope of additional fields, if any, has not been confirmed in public disclosures. Organisations of this type typically hold further details such as addresses, payment information, and booking histories, but it is not possible to state whether those elements were present in the exposed dataset.

What's at stake

For individuals, the exposure of names, phone numbers, and email addresses alongside password hashes can facilitate targeted phishing or attempts to access other accounts where the same credentials may have been reused. IP addresses can contribute to location profiling. For the organisation, the incident adds to the cumulative record of breaches in the mobility sector, potentially affecting customer trust and prompting regulatory scrutiny under applicable data protection rules, though the specific consequences in this case remain undocumented.

What to do if you're exposed

Individuals who suspect their information may have been involved should change passwords on the affected service and any other accounts using the same credentials, enable multi-factor authentication where available, and monitor for unusual account activity. A free exposure scan of an email address against known breach data can be run through services such as Have I Been Pwned to identify whether the address appears in this or other documented incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.