IndiaMART Breach Exposes Over 20 Million User Records
What Happened — A dataset containing 20,154,583 unique IndiaMART accounts—email addresses, names, phone numbers and physical addresses—was discovered for sale on a hacking forum in August 2021. The breach was reported to Have I Been Pwned; the exact cause (design flaw vs. vulnerability) remains unclear.
Why It Matters for Trust & Control Assurance
- Highlights the risk of insufficient privacy‑control documentation; continuous monitoring of data‑handling processes is needed to prove due diligence.
- Demonstrates the value of a defensible audit trail for consent, access, and data‑retention controls.
- Aligns with the CookiePLUS Privacy capability, which automates evidence collection for privacy‑control assurance.
Who Is Affected
- Indian e‑commerce marketplace (IndiaMART) and its millions of buyers and sellers.
- Any organization that stores similar personally identifiable information (PII) for large user bases.
Recommended Actions
- Map your data‑collection, consent, and retention practices to a privacy control objective (e.g., GDPR‑style data‑protection).
- Deploy continuous monitoring tools to detect unauthorized data exposure and generate audit‑ready evidence.
- Conduct a privacy impact assessment to identify gaps and remediate them promptly.
Source: Have I Been Pwned – IndiaMART breach
Technical Notes
- Exposed data types: email addresses, full names, phone numbers, physical addresses.
- Attack vector: unknown – could be a platform‑level vulnerability or a design oversight.
Source: same as above