RentoMojo Data Breach Exposes 2.18 M User Records Including Aadhaar and Passport Numbers
What Happened — In April 2023 the Indian rental‑service platform RentoMojo disclosed that a breach exposed 2,185,697 user accounts. The leak included email addresses, full names, phone numbers, dates of birth, genders, government‑issued IDs (Aadhaar and passport numbers), purchase histories and bcrypt password hashes.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of inadequate data‑protection controls (encryption, access restriction, credential hygiene) that a continuous control‑assurance program is built to detect and remediate.
- Provides a concrete incident that must be documented as evidence of due‑diligence for privacy‑focused audits and regulatory inquiries.
- Highlights the need for verifiable consent and data‑subject request processes that can be demonstrated to regulators and partners.
Who Is Affected – Retail/e‑commerce and subscription‑based SaaS providers that collect personally identifiable information (PII) such as government IDs, payment histories, and authentication credentials.
Recommended Actions
- Conduct a privacy‑impact assessment to map exposed data elements to applicable control objectives (e.g., data minimization, encryption at rest, access logging).
- Verify that password storage uses strong, salted hashing and consider re‑hashing with a more current algorithm.
- Review and tighten consent capture, data‑retention, and DSAR (Data Subject Access Request) processes; ensure they can produce auditable evidence.
- Implement continuous monitoring of credential repositories and public breach feeds to detect future exposures early.
Source: Have I Been Pwned – RentoMojo breach
Technical Notes – The breach’s attack vector was not publicly disclosed (likely a combination of credential compromise and insufficient data‑access controls). Exposed data types: dates of birth, email addresses, genders, Aadhaar numbers, names, passport numbers, passwords (bcrypt hashes), phone numbers, purchase histories, social‑media profiles. Source: same as above