Dunzo dunzo.com Dunzo data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In June 2020 the Indian delivery service Dunzo had a data breach that exposed about 3.5 million email addresses, plus names, phone numbers, IP addresses, device information and locations. Dunzo said card details weren't affected.
View all 13,118 breaches- Breach date
- 19 Jun 2020
- Affected
- 3,465,259
- Data exposed
- Device information, Email addresses, Geographic locations, IP addresses, Names, Phone numbers
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Dunzo is an Indian delivery app. In July 2020 its CTO disclosed a data breach, and reporting at the time said Dunzo's own investigation pointed to a third-party vendor's servers being compromised, which gave the attacker a way into Dunzo's database. Have I Been Pwned dates the breach to 19 June 2020 and counts 3,465,259 exposed accounts.
Sources checked: haveibeenpwned.com, thenewsminute.com, inc42.com
Last verified against the official page:
What was exposed
Have I Been Pwned lists device information, email addresses, geographic locations, IP addresses, names and phone numbers. Dunzo said it doesn't store payment card details on its servers, so card numbers weren't part of it.
A name, a phone number and a location tied to one email address is enough for a convincing scam. A text that mentions a delivery, or a call from someone who knows your name and area, is the realistic risk here.
Dunzo's response
Dunzo said it rotated all access tokens, updated passwords as a precaution, reviewed third-party plugins and integrations, and brought in two outside security firms. Its customer email didn't ask people to change passwords, and passwords weren't among the data types Have I Been Pwned lists.
A breach can't be undone. The data has already circulated, so the useful steps are about the details that can still be abused: your phone number and email.
What to do if you were in it
- 1
Expect phishing that uses these details
Criminals can use leaked names, phone numbers and locations to write messages that look personal. Don't click links in unexpected emails or texts. Go to the company's site yourself.
- 2
Be careful with calls and texts about deliveries
Scammers use delivery themes because they sound routine. If someone contacts you about an order, open the app yourself instead of using a link or number they give you.
- 3
Use a unique password anyway
Passwords weren't listed in this breach, but if your Dunzo password matches one you use elsewhere, change it there. Turn on two-factor login where you can.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web for your email, phone number and other details and alerts you when they show up in a new leak.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by the Dunzo breach?
If you had a Dunzo account in June 2020, your email may be among the 3,465,259 listed on Have I Been Pwned. Search your email there or run a free Serus scan.
What was exposed in the Dunzo breach?
Device information, email addresses, geographic locations, IP addresses, names and phone numbers.
Were my card details exposed?
Dunzo said it doesn't keep card numbers on its servers, and card data isn't among the data types Have I Been Pwned lists.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
