Gaadi – 4.26 Million User Accounts Exposed in 2015 Data Breach
What Happened — In May 2015 the Indian automotive portal Gaadi.com suffered a data breach that exposed 4,261,179 user records. The leaked data included usernames, email addresses, IP addresses, gender, city, phone numbers, and passwords stored both in plain‑text and as unsalted MD5 hashes. The breach was first identified when the data appeared on the Vigilante.pw breach‑dump site.
Why It Matters for Trust & Control Assurance
- The incident highlights the risk of weak credential‑storage controls – a core control objective for any continuous‑control‑assurance program.
- Demonstrable evidence that passwords are protected with strong hashing, salting, and access restrictions is essential for audit readiness across frameworks (e.g., NIST CSF 2.0).
- Continuous monitoring of credential‑management processes and rapid evidence collection can turn a breach investigation into a defensible audit trail.
Who Is Affected
- Automotive‑industry web portals and consumer‑facing SaaS platforms.
- Users whose personal identifiers and login credentials were disclosed.
Recommended Actions
- Conduct an immediate password‑policy review: replace plain‑text and MD5 hashes with salted, adaptive‑hash algorithms (e.g., Argon2, bcrypt).
- Enable multi‑factor authentication for all user accounts and enforce strong password complexity.
- Perform a forensic audit of access logs to identify the breach vector and update the incident‑response playbook with evidence‑preservation steps.
- Notify affected users in line with applicable data‑protection regulations and document all communications for audit purposes.
Technical Notes – The breach appears to have been caused by a server‑side compromise (exact vector not disclosed). No public CVE is associated. Exposed data types: email, username, IP, gender, city, phone, and passwords (plain‑text & MD5). Source: Have I Been Pwned – Gaadi breach