Dunzo Data Breach Exposes 3.46 M User Accounts
What Happened — In June 2019 the Indian on‑demand delivery platform Dunzo suffered a data breach that leaked 3,465,259 unique records. The exposed data set includes email addresses, names, phone numbers, IP addresses, device information and geographic locations, which were later posted on a public hacking forum.
Why It Matters for Trust & Control Assurance
- The incident is a textbook example of why continuous verification of who can access sensitive data is critical; gaps in access‑control monitoring enable large‑scale exfiltration.
- Maintaining immutable logs and evidence of privileged‑access reviews provides the defensible audit trail needed for regulatory and contractual assurance.
- A robust incident‑response and post‑breach review process is essential to demonstrate due diligence to auditors and partners.
Who Is Affected – Logistics & delivery platforms, e‑commerce services that handle large volumes of personal data.
Recommended Actions –
- Review and harden authentication mechanisms (e.g., enforce MFA for all privileged accounts).
- Deploy continuous monitoring of access‑control events and retain tamper‑proof logs.
- Conduct a post‑incident audit to map discovered gaps to your control‑objective framework.
- Update and tabletop‑test your incident‑response playbook with a focus on data‑exfiltration scenarios.
Source: Have I Been Pwned – Dunzo breach
Technical Notes – The exact attack vector was not disclosed; the breach appears to have involved unauthorized extraction of user records and subsequent distribution on a hacking forum. Exposed data types: device information, email addresses, geographic locations, IP addresses, names, phone numbers. Source: HIBP API