Privacy Ninja

Hacker Leaks 20 Million Alleged BigBasket User Records For Free

Hacker Leaks 20 Million Alleged BigBasket User Records For Free

A threat actor has leaked approximately 20 million BigBasket user records containing personal information and hashed passwords on a popular hacking forum.

BigBasket is a popular Indian online grocery delivery service that allows people to shop online for food and deliver it to their homes.

This morning, a well-known seller of data breaches known as ShinyHunters posted a database for free on a hacker forum that he claims was stolen from BigBasket.

BigBasket database leaked for free
BigBasket database leaked for free

In November 2020, BigBasket confirmed to Bloomberg News that they had suffered a data breach after ShinyHunter had previously tried to sell the stolen data in private sales.

“There’s been a data breach and we’ve filed a case with the cybercrime police,” BigBasket CEO  Hari Menon told Bloomberg News. “The investigators have asked us not to reveal any details as it might hamper the probe.”

As is typical for older breaches privately sold by ShinyHunters, the threat actor has now released the whole database for free, which reportedly contains more than 20 million user records.

Also Read: Practitioner Certificate In Personal Data Protection: Everything You Need To Know

The database includes BigBasket customer information, including email addresses, SHA1 hashed passwords, addresses, phone numbers, and other assorted information.

Sample of records in the database
Sample of records in the database

The passwords are hashed using the SHA1 algorithm, and forum members have claimed to crack 2 million of the listed passwords already. Another member claims that 700k of the customers used the password ‘password’ for their accounts.

In the past, ShinyHunters has been responsible for or involved in other data breaches, including TokopediaTeeSpringMintedChatbooksDavePromoMathwayWattpad, and many more.

What should BigBasket customers do now?

As BleepingComputer has confirmed that some of the records are accurate, including information specific to the BigBasket service, customers should play it safe and assume that their customer info has been leaked as well.

It is strongly suggested that all BigBasket users immediately change their passwords on BigBasket and at any other sites using the same password.

Also Read: The DNC Singapore: Looking At 2 Sides Better

A password manager is recommended to help you manage the unique passwords you use at different sites.

Privacy Ninja provides GUARANTEED quality and results for the following CORE SERVICES:

DPO-As-A-Service (Outsourced DPO Subscription)
Vulnerability Assessment & Penetration Testing (VAPT)
PDPA Obligations for Organizational Compliance (SkillsFuture Credit Eligible)


PDPA Compliance Audit
ital Transformation Consultancy
Data Protection Trustmarks Certification Readiness Consultancy

PDPA Data Protection Software
Smart Contract Audit



Leave a Reply

Your email address will not be published. Required fields are marked *


Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection


We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.

Powered by WhatsApp Chat

× How can we help you?