8 Big Indian Data Breaches, and What They Mean for Your Phone Number

Every few months, another Indian company is in the news for a data leak. Most of us read the headline and move on. But each leak puts real names, phone numbers and addresses into the hands of people who use them to call, message and cheat.

Here are eight of the biggest reported leaks of recent years, what each one exposed, and what you can do about it.

1. Star Health (2024)

In September and October 2024, data of about 3.1 crore Star Health customers was found being shared through Telegram chatbots and offered for sale online. Reports said it included names, phone numbers, addresses, PAN and Aadhaar copies, and medical reports. Star Health said it was the target of a "targeted malicious cyberattack" and went to court.

2. Domino's India (2021)

In 2021, a hacker claimed to hold details of about 18 crore orders placed with Domino's India, including names, phone numbers, email addresses and delivery addresses. Jubilant FoodWorks, which runs Domino's in India, said it does not store customers' card details.

3. BigBasket (2020)

In November 2020, details of about 2 crore BigBasket users were reported for sale on the dark web, including names, email addresses, phone numbers and addresses. BigBasket said it did not hold customers' card details and filed a police complaint in Bengaluru.

4. MobiKwik (2021)

In March 2021, data said to cover about 9.9 crore MobiKwik users, including KYC details, was posted online. MobiKwik denied a breach. The RBI then ordered a forensic audit of the company.

5. Air India (2021)

In May 2021, Air India said a cyberattack on its passenger-service provider, SITA, exposed data of about 45 lakh passengers. It included names, dates of birth, contact details, passport details and ticket information.

6. BSNL (2024)

In 2024, a hacker claimed to have taken about 278 GB of BSNL data, including SIM card details. The government told Parliament that CERT-In had reported a possible intrusion at BSNL, and a committee was set up to audit telecom networks.

7. boAt (2024)

In April 2024, a hacker leaked what was said to be data of about 75 lakh boAt customers, including names, addresses, phone numbers and email addresses. boAt said it was looking into it.

8. Hathway (2024)

In January 2024, a hacker posted a database said to come from the internet provider Hathway. An analysis reported by MediaNama found about 40 lakh real accounts, with names, email addresses, phone numbers and home addresses. At the time, Hathway had not confirmed or denied it.

What these leaks have in common

Almost every one of them included the same two things: your phone number and your email address. Those are exactly what a scammer needs to call you, send a fake KYC message, or pretend to be your bank. A leak that happened years ago can still lead to a call today, because leaked lists are copied and sold again and again.

What you can do now

1. Never share an OTP, PIN or password on a call, even if the caller knows your name and address. Knowing your details does not make them genuine.
2. Register on DND by sending "FULLY BLOCK" to 1909 from your phone, to cut down marketing calls from registered telemarketers.
3. Change passwords you reused on any of these sites, and turn on two-step login where you can.
4. Report fraud fast: call 1930 or file at cybercrime.gov.in if you lose money.

ScamSafe's free scan shows where your phone number and email have appeared in known leaks, so you know which companies may have your details.