Search This Blog

Showing posts with label Upstox. Show all posts

Threat Actors Target India's No. 2 Discount Broker 'Upstox'; Personal Data of 2.5 Mn Users Leaked


Retail broking firm Upstox suffered a massive data breach affecting the personal data of 2.5 Mn of its customers, according to several media reports on Sunday (April 11, 2021). Thereafter, the company admitted that earlier claims about the data breach were right and it has since strengthened its cybersecurity systems. 

According to cybersecurity researcher Rajshekhar Rajaharia, 2.5 Mn users were affected and 56 Mn KYC data files were leaked — including email, date of birth, passport, PAN, etc. — by hacker group ShinyHunters. 

The hacking group is rumored to have been behind multiple data breaches of Indian startups over the past one year such as Dunzo, BigBasket, JusPay, ChqBook, among others. 

“We have upgraded our security systems manifold recently, on the recommendations of a global cyber-security firm. We brought in the expertise of this globally renowned firm after we received emails claiming unauthorized access into our database. These claims suggested that some contact data and KYC details may have been compromised from third-party data-warehouse systems,” said the company on its blog. 

The Upstox data leak comes at a time when cybersecurity breaches seem to have picked pace in the past few months — from the data leak of 100 Mn Mobikwik users to 500 Mn+ Facebook users (of which 6 Mn were Indian accounts) to over500 Mn LinkedIn users.

In one of the biggest data breaches in India, in March, Gurugram-based fintech company MobiKwik was rocked by the allegations of data of over 100 Mn users being leaked. The allegation that was repeatedly denied by the company also led to a warning by the RBI who ordered an external auditor to conduct a forensic audit on the breach.

Last week, Microsoft-owned LinkedIn denied the breach, but Cyber News had reported that scraped data of over 500 Mn LinkedIn users was put for sale on a hacker forum. The data up for sale included account IDs, full names, email addresses, phone numbers, workplace information, and links to social media accounts among other details. 

In the case of Facebook, leaked data of 533 Mn users was posted for free on hacking forums and included the date of joining, place of work, names, gender, occupation, and relationship status of users. The breach affected 6 Mn Indian users and included details such as phone numbers, Facebook IDs, full names, locations, birthdates, bios, and in some cases email addresses. The social media giant told media agencies that the leak was related to a vulnerability that the company patched in 2019.

Hackers Expose Contact and KYC Details of Upstox Clients


Upstox, India's second-biggest broking firm in terms of the number of active customers, disclosed that its databases, including contact details and know-your-customer (KYC) details, may have been breached. The Delhi-based discount brokerage firm, anyway thought that it has improved its security systems at its servers manifold recently, on the suggestions of a global cyber-security firm against a suspected data breach. 

The organization has guaranteed the customers that their funds and securities are protected and remain safe. Sources propose that Upstox has endured a huge information breach that has uncovered some significant information like Aadhaar, PAN, bank account numbers, canceled cheques, signatures, and photographs apart from other personally identifiable information like passport, mobile numbers, and email addresses.

“On receipt of e-mails claiming unauthorized access into our database, we have appointed a leading international cyber-security firm to investigate possibilities of breach of some KYC data stored in third-party data warehouse systems. This morning, hackers put up a sample of our data on the dark web,” a company spokesperson said in an e-mailed statement. 

The spokesperson added that as a proactive measure, the organization has started numerous security upgrades, especially at the third-party warehouses, continuous 24x7 monitoring, and additional ring-fencing of its network. 

“As a matter of abundant caution, we have also initiated a secure password reset via OTP for all Upstox users. Upstox takes customer security extremely seriously. Funds and securities of all Upstox customers are protected and remain safe. We have also duly reported this incident to the relevant authorities,” the spokesperson said. The spokesperson further said that at this point, “We don't know with certainty the number of customers whose data has been exposed.” 

Upstox, upheld by investors like Tiger Global and Ratan Tata, has more than 3,000,000 clients. In an announcement note on the organization site, Upstox co-founder and CEO Ravi Kumar said funds and securities of customers are protected and remain safe. 

“Funds can only be moved to your linked bank accounts and your securities are held with the relevant depositories. As a matter of abundant caution, we have also initiated a secure password reset via OTP. Through this time, we have also strongly fortified our systems to the highest standards,” he said.