24.5 Million Customer Records Exposed in Bigbasket Data Breach
What Happened – In October 2020 the Indian online grocery platform bigbasket suffered a breach that released more than 24 million customer records. The leaked dataset, later sold on underground forums, contained names, email and IP addresses, phone numbers, dates of birth, physical addresses, and password hashes (Django SHA‑1).
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of weak credential storage – a control gap that continuous‑monitoring programs are built to detect and remediate.
- Highlights the need for auditable evidence that password policies, hashing algorithms, and MFA are enforced across all consumer‑facing applications.
- Provides a real‑world example of why a documented incident‑response and data‑protection posture is essential for regulatory and audit readiness.
Who Is Affected – Retail & e‑commerce operators handling large volumes of consumer PII; any organization that stores passwords using outdated hashing methods.
Recommended Actions
- Replace SHA‑1 password hashes with a modern, salted algorithm (e.g., bcrypt, Argon2).
- Enforce multi‑factor authentication for all customer‑facing accounts.
- Conduct a credential‑exposure audit and integrate continuous breach‑monitoring feeds into your security operations.
- Update privacy notices and ensure data‑retention policies align with applicable regulations.
Source: Have I Been Pwned – bigbasket breach
Technical Notes – The breach appears to have originated from a compromised database export; no specific CVE was disclosed. Passwords were stored as Django SHA‑1 hashes, which are vulnerable to fast offline cracking. The data set includes IP addresses, indicating possible correlation with login activity.
Source: same as above