Angel One Breach Exposes Over 6.7 M Customer Accounts in India
What Happened – In April 2023 a data breach at Indian stock‑brokerage Angel One resulted in the unauthorized release of 6.8 million unique email addresses plus names, physical addresses, phone numbers, bank account numbers, PAN identifiers and portfolio holdings. The breach was publicly confirmed in July 2024 after the data appeared on public‑facing sites.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous privacy‑control monitoring and auditable evidence that personal and financial data are protected.
- Highlights gaps in data‑classification, consent management and DSAR (Data Subject Access Request) readiness that a control‑assurance program must address.
- Shows why a unified Trust Center that records privacy‑control evidence is essential for defensible audit trails.
Who Is Affected – Retail investors and individual clients of Angel One (financial services sector).
Recommended Actions
- Map the exposed data elements to your privacy‑control objectives (e.g., consent, data minimisation, DSAR handling).
- Validate that consent records and data‑retention policies are enforceable and can be produced as audit evidence.
- Strengthen incident‑response documentation and ensure continuous monitoring of data‑access controls.
Technical Notes – The breach source has not been publicly disclosed; no specific vulnerability or CVE was identified. Exfiltrated data includes personally identifiable information (PII) and financial identifiers. Source: Have I Been Pwned – Angel One breach