Indian Data Breach Index: Every Major Leak Explained

A Telegram bot handed out Aadhaar numbers, phone numbers, and vaccination details for hundreds of millions of Indians in 2023. You typed a name. It returned a person’s entire CoWIN record. No password. No verification. Just open access to some of the most sensitive government-held data in the country.

That incident was not an outlier. It was the pattern.

India has experienced some of the largest-scale data exposures globally. These breaches affected hundreds of millions of individuals, and most never triggered a meaningful response. This post documents every major breach and what was specifically exposed. It also covers how criminals used the data, and what you should do if your information was part of any of them.

Bookmark this page. Return to it. The list will grow.

The short answer: India has suffered some of the world’s largest data breaches. They range from the 2018 Aadhaar portal leak (1.1 billion records) to the 2024 Star Health breach (31 million). Criminals use this data for SIM swap fraud, KYC fraud, targeted phishing, and loan fraud. To check your exposure, search Have I Been Pwned and review your Aadhaar authentication history at resident.uidai.gov.in. If exposed, change reused passwords, enable app-based two-factor authentication, lock your Aadhaar biometric, and monitor your credit report.

In this article:

Why is India’s data so exposed?

India digitized at extraordinary speed. The JAM trinity is Jan Dhan bank accounts, Aadhaar biometric IDs, and Mobile connectivity. It linked over a billion people to digital financial services in under a decade. That was genuinely remarkable. The security infrastructure meant to protect all that data did not grow at the same pace.

By 2024, India had more than 900 million internet users. Aadhaar was linked to bank accounts, mobile numbers, insurance policies, tax records, and vaccination databases. Every linkage created a new attack surface.

Enforcement lagged badly. Before the Digital Personal Data Protection Act 2023 (DPDPA), India had no dedicated data protection law. Companies could lose your data, deny it, and face no real consequence. Some did exactly that.

India generates more data than it can currently protect. That gap — between digitization speed and security maturity — is why this list exists.

The major breaches — what was exposed

These are the incidents that defined Indian data breach history. Dates, record counts, and exposed data types are sourced from security researchers, investigative journalism, and breach databases.

Aadhaar (2018)

Records exposed: 1.1 billion

In January 2018, The Tribune reported that a journalist had purchased access to an Aadhaar data portal for ₹500. The portal was sold through anonymous WhatsApp groups. It let anyone search any Aadhaar number and retrieve the linked name, address, phone number, email address, and photo.

The breach traced to an API vulnerability in the UIDAI (Unique Identification Authority of India) system. A separate exploit allowed the creation of unauthorized Aadhaar printouts through the same access. Effectively, the entire Aadhaar database was queryable by anyone willing to pay ₹500.

UIDAI initially denied the breach. They later confirmed that an unauthorized access channel had existed. The full scope — who used it, for how long, what data was extracted — was never publicly disclosed.

What criminals did with it: Aadhaar data became the backbone of KYC fraud. With a name, date of birth, Aadhaar number, and address, fraudsters could impersonate individuals to open bank accounts, apply for loans, and port mobile numbers.

JustDial (2019)

Records exposed: 100 million+

Security researcher Rajshekhar Rajaharia disclosed in April 2019 that JustDial’s API was returning unauthenticated user records. Any request to their API — the same one that powered their app — returned detailed personal profiles without requiring login credentials.

The data included names, phone numbers, email addresses, gender, date of birth, profile photos, occupation, and in some cases payment method information. JustDial patched the vulnerability after disclosure, but the window of exposure had been open for years.

One hundred million people’s contact details, sitting in an API with no authentication gate. That is not a software bug. That is a systems failure.

BigBasket (2020)

Records exposed: 20 million

In October 2020, cybersecurity firm Cyble found a database containing 20 million BigBasket user records for sale on the dark web. The data included names, email addresses, phone numbers, hashed passwords, dates of birth, IP addresses, and home delivery addresses.

BigBasket confirmed the breach in November 2020. The hashed passwords were bcrypt-encrypted, which provides some protection — but names, phone numbers, and addresses were in plaintext. Delivery addresses are particularly sensitive because they confirm physical location.

MobiKwik (2021)

Records exposed: 100 million users, 8.2 TB of data

In March 2021, researchers discovered a 8.2 terabyte database on a dark web marketplace containing MobiKwik user data. The exposure included phone numbers, email addresses, hashed passwords, IP addresses, and GPS locations. Most seriously, it included KYC documents: scanned Aadhaar cards, PAN cards, and passport photos.

MobiKwik denied the breach publicly and suggested the data came from user devices rather than their systems. The data appeared on the dark web regardless of the denial. Researchers were able to verify personal records by matching them against their own accounts.

KYC document exposure is a different category of harm. Aadhaar scans and PAN cards handed to criminals give them everything needed to commit identity theft at scale. (MobiKwik denied the breach; the data was reported by independent security researchers but never confirmed by the company.)

AIIMS Delhi (2022)

Records exposed: estimated 40 million patient records

In November 2022, the All India Institute of Medical Sciences in Delhi suffered a ransomware attack that took down hospital servers for roughly two weeks. Emergency patient care had to be managed manually. The attackers reportedly demanded ₹200 crore in cryptocurrency.

AIIMS Delhi is not just any hospital. It treats senior government officials, ministers, and prominent public figures. The attackers understood that patient data from this institution had leverage beyond ordinary medical records.

The Indian Computer Emergency Response Team (CERT-In) investigated but full details of what data was exfiltrated were not disclosed publicly. Medical records are among the most sensitive personal data — they can be used for blackmail, insurance fraud, and targeting high-value individuals.

CoWIN (2023)

Records exposed: unconfirmed, widely reported

In June 2023, a Telegram bot began returning detailed CoWIN vaccination records in response to phone number queries. The records included Aadhaar numbers, dates of birth, vaccination status, and beneficiary details.

The Indian government stated that the CoWIN data had not been breached directly. The bot was pulling from a previously compromised health worker database that had API access to CoWIN. That distinction mattered for the government’s statement. It did not matter for the people whose vaccination records and Aadhaar numbers were publicly accessible through a Telegram search.

This is the breach that most clearly illustrated how data linkage creates cascading exposure. One compromised database became a key that opened another.

Star Health Insurance (2024)

Records exposed: alleged 31 million

In October 2024, a threat actor operating under the name “xenZen” claimed to have obtained 31 million customer records from Star Health and Allied Insurance. The data reportedly included policyholder names, phone numbers, addresses, policy details, claims data, and medical records including diagnoses and treatment histories.

The attacker claimed the data was obtained through a senior Star Health executive who sold access. Star Health filed a legal case and initially disputed the claims. Data samples were made available through Telegram bots before the bots were taken down via legal injunctions.

Medical and insurance claims data is among the worst categories of exposure. It reveals health conditions, financial situations, and physical addresses simultaneously.

What do criminals do with breached Indian data?

Understanding the harm matters. Breach data does not just sit on a dark web server — it gets used, repeatedly, by multiple actors.

SIM swap fraud is one of the most common outcomes. A fraudster calls your mobile operator with your Aadhaar number, name, and date of birth (all available from multiple breaches). They claim to have lost their SIM. The operator ports your number to a new SIM. The fraudster now receives your OTPs and can access your bank accounts, UPI wallets, and email.

Phishing with breach data is more targeted than generic phishing. Instead of “Dear Customer,” you get a call or message that opens with your real details. It might say they’re calling about your Star Health policy number XXXXX. You assume the caller is legitimate because they know your policy number. They are not. They bought the data.

KYC fraud exploits the MobiKwik and Aadhaar breach data specifically. With a scanned Aadhaar and PAN, fraudsters open bank accounts, apply for personal loans, and purchase SIM cards in your name. You find out when a debt collector calls about a loan you never took.

Loan fraud has surged. Digital lending apps require minimal verification. Breach data provides everything needed to apply. Victims discover fraudulent loans when their credit scores drop or when lenders contact them for repayment.

How to check if your data was in a breach

Start with HaveIBeenPwned.com — enter your email address and it will show you every known breach where that email appeared. It covers BigBasket, JustDial, and dozens of other Indian companies whose data ended up in international breach databases.

HaveIBeenPwned does not cover all Indian breaches. The CoWIN and Aadhaar incidents are not indexed there because the breach data was not submitted to their system. For those, you need to check your Aadhaar authentication history.

Open mAadhaar or visit resident.uidai.gov.in and check your authentication history. This log shows every time your Aadhaar was used for authentication. Unknown entries are a red flag.

For phone-number-based breaches (JustDial, CoWIN), watch for unsolicited calls that reference specific personal details. That could be a date of birth, an address, or a policy number. That specificity tells you the caller has breach data, not just a random dialing list. Breach data also feeds people-search sites that resell your details.

What to do if your data was exposed

Act in this order.

Change passwords immediately for any service named in a breach you were part of. Use a unique password for each service — a password manager makes this manageable. If you reused passwords across services, change all of them.

Enable two-factor authentication (2FA) on your bank accounts, email, and UPI apps. Use an authenticator app rather than SMS-based OTP where possible — SIM swap fraud defeats SMS 2FA. Google Authenticator and Authy both work well.

Monitor your credit report if your KYC documents or financial data was exposed. CIBIL, Experian, and CRIF all offer free credit reports. Look for accounts or enquiries you did not initiate.

Register a complaint with CERT-In (cert-in.org.in) if you have evidence of identity fraud resulting from a breach. File an FIR with your local cyber crime cell. These steps create a paper trail that helps dispute fraudulent accounts.

Lock your Aadhaar biometric if you are not actively using it. The UIDAI allows you to temporarily lock biometric authentication through mAadhaar. This prevents someone from using your fingerprint for authentication even if they have your Aadhaar number.

Watch your bank statements and UPI transaction history weekly. Unauthorized transactions should be reported to your bank within 24 hours to maximize the chance of reversal under RBI guidelines.

Why do breaches keep happening in India?

The honest answer is that India’s legal framework created almost no incentive for companies to invest in security or disclose breaches.

CERT-In’s 2022 directive mandated that companies report breaches within six hours. The directive exists. Enforcement is a different matter. MobiKwik denied their breach. Star Health disputed the scale of theirs. AIIMS Delhi’s full disclosure never materialized. The pattern is denial, deflection, and minimal disclosure — because the consequences of full transparency have historically been limited.

The DPDPA 2023 changed the legal landscape. It requires data fiduciaries to notify affected individuals and the Data Protection Board of breaches. Penalties reach ₹250 crore. The DPDP Rules were notified in November 2025 and the Board was legally established. But as of mid-2026 the Board is still not fully operational, obligations phase in through 2026–2027, and no enforcement cases have yet been pursued.

Security investment at Indian companies has not kept pace with the scale of data they handle. The BigBasket breach involved hashed passwords — at least they hashed them. The JustDial breach involved an unauthenticated API returning full user records — that is a basic security failure that should never reach production.

The gap between digital ambition and security practice is where breaches happen. India is closing that gap, but slowly.

Frequently asked questions

What are the biggest data breaches in India? The 2018 Aadhaar portal leak (1.1 billion records), JustDial (2019, 100M+), MobiKwik (2021, 100M with KYC scans), AIIMS Delhi (2022), CoWIN (2023), and Star Health (2024, 31M with medical records) are the largest documented ones.

How do I check if my data was leaked in India? Search your email at Have I Been Pwned, and review your Aadhaar authentication history at resident.uidai.gov.in or in the mAadhaar app. Watch for calls that quote your real personal details.

What do criminals do with breached Indian data? SIM swap fraud, KYC fraud (opening accounts with your Aadhaar and PAN), targeted phishing that quotes real policy numbers, and instant-loan fraud. You often find out when a lender chases a loan you never took.

Can I get compensation for a data breach in India? Not through the DPDPA yet, as the Data Protection Board isn’t fully operational as of mid-2026. Today you can use IT Act Section 43A or the consumer forum. See our India data breach compensation guide.

What you can do right now

Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.