Indian car-sharing platform Zoomcar Holdings has suffered a significant data breach affecting 8.4 million users, the company disclosed following a cybersecurity incident detected on June 9, 2024.
## How the Breach Was Discovered
The breach came to light when company employees received emails from threat actors claiming unauthorized access to Zoomcar’s systems. This unusual notification method prompted an immediate internal investigation that confirmed the security incident.
## About Zoomcar
Zoomcar operates as a peer-to-peer car-sharing marketplace connecting vehicle owners with renters across emerging Asian markets. The company went public in late 2023 through a merger with American firm IOAC and now trades on NASDAQ under the ticker ZCAR.
## Compromised Data
The preliminary investigation revealed that hackers accessed the following information for 8.4 million customers:
– Full names
– Phone numbers
– Car registration numbers
– Home addresses
– Email addresses
## What Wasn’t Compromised
Zoomcar emphasized that no evidence suggests exposure of:
– Financial information
– Plaintext passwords
– Other sensitive data that could enable identity theft
## Company Response
As a U.S.-listed company, Zoomcar must report the incident to the Securities and Exchange Commission (SEC) under financial reporting requirements. The company states that services remain unaffected and continues evaluating the breach’s full scope and impact.
## Previous Security Issues
This marks Zoomcar’s second major data breach. In 2018, the company experienced a breach exposing 3.5 million customer records, including names, emails, IP addresses, phone numbers, and encrypted passwords. That stolen data later appeared for sale on underground marketplaces in 2020.
## Current Status
The attack method remains undetermined, and no ransomware group has claimed responsibility. Zoomcar has not responded to requests for additional details about the incident’s nature or the company’s specific response measures.
The breach highlights ongoing cybersecurity challenges facing digital platforms handling large volumes of personal data, particularly in the growing car-sharing industry.