Zoomcar Data Breach Exposes 3.59 M Customer Records
What Happened
In July 2018, Zoomcar’s user database was compromised. The breach, later sold on a dark‑web marketplace in 2020, released 3,589,795 records containing names, email addresses, IP addresses, phone numbers, and bcrypt‑hashed passwords.
Why It Matters for Compliance & Audit Readiness
- Demonstrates the need for continuous credential‑storage hardening and proof of password‑hashing standards (e.g., bcrypt) as a control‑assurance checkpoint.
- Highlights the importance of maintaining an auditable log of third‑party data‑handling activities to satisfy privacy‑by‑design requirements (e.g., GDPR, India’s PDPB).
- Reinforces that a robust incident‑response documentation process is essential for demonstrating due‑diligence during regulator‑led audits.
Who Is Affected
- Ride‑sharing and car‑rental platforms operating in India.
- Any service that stores personally identifiable information (PII) and authentication credentials.
- End‑users of Zoomcar’s self‑drive rental service.
Recommended Actions
- Review Zoomcar’s vendor‑risk posture and confirm contractual security clauses are being met.
- Validate that password‑hashing algorithms remain up‑to‑date and that salts are unique per user.
- Request a detailed incident‑response report from Zoomcar, including timeline, root‑cause analysis, and remediation steps.
Technical Notes
- Attack vector: Likely unauthorized database access (specific method not disclosed).
- CVEs: None publicly linked to this breach.
- Data types exposed: Email addresses, IP addresses, names, phone numbers, bcrypt‑hashed passwords.