In October 2020, BigBasket — India’s largest online grocery platform — suffered a breach that exposed 20 million user records. Names, email addresses, phone numbers, physical addresses, dates of birth, and hashed passwords. If you were a BigBasket user at the time, your data went somewhere you didn’t choose, with people you’ll never identify.
Six months after a breach like that, across the world, someone opened a credit card in your name. A loan application followed. Then a mobile account. You found out fourteen months later when your credit score dropped forty points and a collections agency rang.
What happened in between? That gap — from breach to fraud — is exactly what this post traces. Not abstract risk. The actual mechanics, stage by stage.
The chain that starts with a breach you didn’t cause
You made no mistake. You created a BigBasket account to order groceries. You trusted a company to protect your data. They failed — through a misconfigured database, an unpatched server, a compromised admin credential. The cause doesn’t matter to you. The outcome does.
Your data moved through a predictable chain from the moment it left that server. First to private buyers. Then to secondary markets. Eventually into public combolists downloaded by thousands of automated tools running credential stuffing attacks, social engineering scripts, and fraud operations. The chain runs whether you know about it or not.
Walking that chain backwards from the fraud to the breach requires understanding four stages: the sale, the enrichment, the targeting, and the attack. Most people never see any of them.
Stage 1: The breach and the sale
Breached data doesn’t sit idle. Within days — sometimes hours — of a successful attack, the data is packaged and sold.
The first buyers are on private dark web forums: organized criminal groups, fraud-as-a-service operations, and financially motivated actors who pay a premium for fresh, exclusive data. A full KYC package bundles name, address, national ID number (SSN, Aadhaar, NI number), date of birth, and phone. It sells for $10 to $150, depending on the country, data completeness, and how recently it was breached. UK and US records command higher prices. Indian and Southeast Asian records sell at lower rates but in larger volume.
As weeks pass and the breach ages, the data moves into secondary markets. Buyers who missed the initial sale pick it up cheaper. Then it degrades further into shared access: combolists distributed across Telegram channels, paste sites, and forum threads with millions of records available for free.
Fresh breach data is dangerous because it hasn’t been used yet. Old breach data is dangerous because it has been cross-referenced, enriched, and compiled into something more complete than the original breach ever contained.
Stage 2: Data enrichment
No single breach contains everything an attacker needs. That’s where data brokers become the attacker’s infrastructure. Companies like Spokeo, Whitepages, FastPeopleSearch, and their regional equivalents fill in the gaps.
Your email address from the BigBasket breach. Your current address from a people-search site that aggregated it from public records. Your employer from LinkedIn. Your approximate income from property records. Your family members from social media. Within hours of targeted research, a criminal operation has a file on you that no single breach could have produced.
This is why data brokers make breach data more dangerous. They are the enrichment layer. They exist to aggregate and sell personal profiles, and they don’t ask who’s buying. A name and email becomes a full identity file. A partial record becomes a complete one. The breach opened the door; the broker ecosystem built the house.
The BigBasket breach included physical addresses. That alone — paired with a name and email from another source — is enough to pass identity verification at many financial institutions. Attackers know this. That’s why cross-referencing happens automatically, at scale, before any fraud attempt is made.
Stage 3: The fraud types — what each data element enables
Not all stolen data enables the same attack. Attackers select the fraud type based on what they have.
Name + address + date of birth → This combination opens bank accounts, passes identity verification for credit applications, enables government benefit fraud, and allows package interception (redirecting deliveries to a different address after ordering with your account). It’s also the base layer for almost every other fraud type — everything else gets built on top of it.
Email + password → Account takeover is immediate. Attackers run credential stuffing: your email and password pair tested against hundreds of sites automatically. Your email, your bank, your PayPal, your Amazon account. Password reset chains extend the damage — once inside your email, they can reset access to every account linked to that address. Linked financial accounts are the end goal.
National ID (SSN, Aadhaar, NI number) → This is the highest-value single element in any breach. With a national ID, attackers apply for credit, file fraudulent tax returns, claim government benefits in your name, and obtain employment under your identity. The SSN in the United States, the Aadhaar number in India, and the National Insurance number in the United Kingdom each unlock separate categories of institutional fraud.
Payment card data → Two attack vectors. Card-not-present fraud uses the card number, expiry, and CVV to make online purchases before the card is flagged. Card cloning writes the magnetic stripe data to a blank card for in-person use. Card data is the most time-sensitive: fraud windows close as banks detect anomalies. A stolen card number is often monetized within twenty-four hours.
Medical records → Medical identity theft bills fraudulent procedures and prescriptions to your health insurance. The financial damage is significant. The physical danger is worse — your medical records now contain false information that doctors rely on in emergencies.
Full KYC package (name + national ID + address + photo) → This enables everything above, plus SIM swap attacks. In a SIM swap, an attacker convinces a carrier to transfer your phone number to a device they control. That intercepts every SMS-based authentication code for every account you own. A full KYC package is what makes SIM swaps possible at scale.
Financial identity theft: the most common type
Someone opens a credit card in your name. Then a personal loan. Then a store account. They max out the card and disappear. The accounts go to collections.
You find out in one of a few ways. Your credit score drops unexpectedly. A collections agency contacts you for a debt you don’t recognize. Or you’re denied a loan for a car you planned to buy. The average victim doesn’t discover financial identity theft for approximately 6 months (Javelin Strategy & Research). By then, the fraudulent accounts have aged, the debt has compounded, and the collections entries are established.
That’s a system failure. Credit bureaus process new account applications without confirming the applicant is who they claim to be. The burden of proof falls on the victim. You have to prove you didn’t open an account — not the other way around.
Fraud alerts and credit freezes exist precisely because the system defaults are broken. A freeze prevents new credit from being opened in your name entirely. It’s free in the US; the UK equivalent (CIFAS Protective Registration) costs £25 for two years. It should be the default. It isn’t.
Tax fraud: the attack that surprises people
The mechanism is simple: an attacker files a tax return in your name before you do. They claim a large refund. The refund goes to an account they control. When you file your legitimate return, it’s rejected — the government’s system flags it as a duplicate submission.
The US IRS processes roughly 1 million fraudulent returns per year. India’s GST system faces parallel fraud involving fake invoicing and refund claims against real business registration numbers. The UK’s HMRC sees similar patterns with fraudulent self-assessment returns.
The fix is equally simple: file early. Every year, file before attackers have a chance to file in your name first. In the United States, the IRS offers an Identity Protection PIN — a six-digit code that must accompany any return filed under your SSN. Anyone can apply for one now, not just prior victims. Get one.
Medical identity theft: the dangerous one
Medical identity theft doesn’t get the attention it deserves, because the fraud often stays hidden for years and the damage isn’t measured in dollars alone.
Someone uses your health insurance details, such as your policy number, provider, and coverage tier. They bill for procedures they never received, prescriptions they fill and sell, and medical equipment they resell. Your insurance pays. You don’t notice until your benefits are exhausted or a provider flags an anomaly.
The records problem is worse than the financial problem. Your medical file now contains procedures attributed to you that you never had. A blood type that isn’t yours. Medications listed as current prescriptions that you’re not taking. Allergies removed because the fraudster didn’t have them. In an emergency room, when a doctor checks your records and acts on that information, the consequences are direct and physical.
This is the fraud type that doesn’t just cost money. It can hurt you in ways that have nothing to do with your bank balance. We cover it in depth in our medical identity theft guide.
Synthetic identity fraud
Synthetic identity fraud sits at the intersection of real and fabricated data. An attacker takes your real national ID number — your SSN, your Aadhaar — and combines it with an invented name, a false address, and a fabricated date of birth. The result is a ghost identity that doesn’t correspond to any real person.
The ghost builds credit over months. Small credit card, paid on time. Then a larger line of credit. Then a personal loan. Then the ghost disappears — a practice called “busting out” — taking every dollar of available credit with it.
You never receive a collections notice because the fraud isn’t in your name. Your national ID was used, but your identity wasn’t assumed. The damage shows up differently: your ID number appears in contexts you don’t recognize, credit applications you didn’t make, and — eventually — on credit reports that share your number under a different name.
For a full breakdown of how this works and how to detect it, see our guide to synthetic identity fraud.
The recovery timeline — what it actually takes
The Identity Theft Resource Center puts the average identity theft resolution at 200 hours of effort over six months. That’s a conservative estimate for straightforward cases. Complex ones — involving multiple accounts, multiple fraud types, or attackers who established credit in your name years ago — take longer.
The steps are:
- File a police report. Get a case number. You’ll need it.
- File a report at IdentityTheft.gov (US) or your national equivalent. The FTC’s site generates a recovery plan and pre-filled letters for each institution.
- Place a fraud alert or credit freeze with all three major credit bureaus (Equifax, Experian, TransUnion in the US; Equifax, Experian in the UK; CIBIL, Experian, Equifax, CRIF in India).
- Contact every financial institution where fraud occurred. Dispute each account in writing. Keep records of everything.
- If your national ID was compromised: contact the issuing agency directly. The IRS, Aadhaar’s UIDAI, or HMRC each have specific processes for compromised ID numbers.
Some cases require court orders to fully remove fraudulent records. Some take years. The institutions that created the problem — by extending credit without adequate verification — are rarely held accountable. The victim carries the administrative weight.
For a step-by-step recovery checklist, see what to do after a data breach.
Warning signs you’ve been a victim
Identity theft announces itself — but quietly, and not always in ways you’d immediately connect to a breach.
Watch for these:
- Unexplained credit score drops of 20 points or more with no obvious cause
- Unknown accounts appearing on your credit report
- Bills or collection notices for purchases you didn’t make
- Tax return rejected as a duplicate when you file
- Medical claims on your insurance for procedures you didn’t have
- Being denied credit unexpectedly despite a clean payment history
- Hard inquiries on your credit report from lenders you never contacted
- Calls from debt collectors about debts you don’t recognize
- Missing expected mail — statements that stopped arriving (a sign someone changed your address)
Any one of these warrants a full credit report pull immediately. In the US, you’re entitled to one free report from each bureau per week at AnnualCreditReport.com. Don’t wait for an annual review. Check now.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.