In November 2020, Bangalore-based online grocer BigBasket suffered a breach involving data from more than 20 million users. The exposed information reportedly included email addresses, password hashes, PINs, phone numbers, physical addresses, dates of birth, locations and IP addresses. The data was advertised on the dark web for approximately ₹3 million, or about US$40,000 in 2020. The incident was identified after the stolen material appeared for sale rather than through a publicly described internal detection process.
Reports attributed the exposure to an insecure SQL file containing more than 15 gigabytes of customer data and suggested that SQL injection may have been used, although the source presents that mechanism as potential rather than proven. BigBasket acknowledged the breach and filed a complaint with the Bangalore Cyber Crime cell; the investigation was ongoing. The case illustrated how a consumer platform’s database could turn ordinary shopping records into a combined identity, location and account-security dataset, while the presence of password hashes still created risks of credential cracking and reuse.
