Upstox upstox.com Upstox data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In April 2021 Indian brokerage Upstox suffered a data breach exposing over 100,000 customers' details in Have I Been Pwned: names, dates of birth, addresses, bank details, identity documents with Aadhaar numbers, and bcrypt-hashed passwords.
View all 13,118 breaches- Breach date
- 8 Apr 2021
- Affected
- 111,002
- Data exposed
- Bank account numbers, Dates of birth, Email addresses, Family members' names, Genders, Government issued IDs, Income levels, Marital statuses, Nationalities, Occupations, Passwords, Phone numbers, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Upstox is an Indian brokerage. Have I Been Pwned records a data breach in April 2021 that exposed 111,002 customers, and added it on 19 January 2022. Upstox disclosed the incident to customers in April 2021. It said it had hired an international cybersecurity firm to investigate possible exposure of KYC ("know your customer") data held in third-party data warehouse systems, started a password reset by one-time code for all users, and reported the incident to the authorities. It said customer funds and securities were safe. The company also said it didn't know with certainty how many customers were affected, and other outlets reported much larger numbers than Have I Been Pwned's.
Sources checked: haveibeenpwned.com, business-standard.com, csoonline.com
Last verified against the official page:
What was exposed
Have I Been Pwned lists names, genders, dates of birth, physical addresses, phone numbers, email addresses, bank account numbers, income levels, marital statuses, nationalities, occupations, family members' names, government issued IDs and passwords stored as bcrypt hashes. KYC scans included bank statements, cheques and identity documents with Aadhaar numbers.
What it means for you
Identity documents and bank details are what criminals need for impersonation and for fraud that sounds informed: a caller who knows your bank and address is far more persuasive. That risk outlasts a password change.
What to do if you were in it
- 1
Never share OTPs or PINs
Fraudsters who hold your details may call posing as Upstox, your bank or a regulator. Never read out a one-time code, PIN or password, and call back on an official number.
- 2
Watch your bank and brokerage accounts
Check statements for transfers you don't recognise and tell your bank quickly if you see any. Ask about extra alerts on your account.
- 3
Change your password, and any reuse of it
Change your Upstox password, then change it on every other account where you used the same or a similar one. Use a password manager so each account gets a unique password, and turn on two-factor login where it's offered.
- 4
Expect phishing that mentions the breach
Scammers use leaked email addresses and phone numberses to send convincing messages. Don't click links in unexpected emails or texts about your account, and go to the site directly instead.
- 5
Treat identity documents as exposed
Be careful when anyone asks for copies of your ID, and where the law in your country allows it, ask about ways to lock or restrict how your ID number is used.
- 6
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches include your email address or phone number. Serus keeps monitoring breach databases and the dark web and alerts you when your details show up in a new leak. It can't remove data that has already leaked.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by the Upstox breach?
If you were an Upstox customer in April 2021, your details may be among the 111,002 Have I Been Pwned lists. Upstox emailed affected customers at the time.
What was exposed?
Names, dates of birth, addresses, contact details, bank account numbers, government issued IDs including Aadhaar numbers, and bcrypt-hashed passwords.
Were my funds at risk?
Upstox said customer funds and securities were safe. The exposed identity and bank details still carry fraud risk, so watch your accounts.
Sources
- Have I Been Pwned: Upstox
- Have I Been Pwned: Upstox Data Breach · haveibeenpwned.com
- Upstox alerts users of data breach; says funds, securities remain safe · business-standard.com
- Upstox shows MobiKwik how to manage a data breach incident · csoonline.com
Something wrong or out of date? Tell us and we'll re-check it.
