India-based cryptocurrency exchange, BuyUcoin suffered a security incident in which the attackers leaked sensitive data of 325K users on the Dark Web.
The leaked data includes names, e-mails, mobile numbers, encrypted passwords, user wallet details, order details, bank details, KYC details (PAN number, passport numbers) and deposit history.
According to the researcher Rajshekhar Rajaharia who had analyzed the leaked data, it is a MongoDB database of 6GB that contains three backup files with BuyUcoin data.
The threat intelligence firm Kela Research discovered the data, and it was leaked by the threat actor known as ShinyHunters.
BuyUcoin has not confirmed the security incident and has only announced the launch of an investigation.
As the data is available on the dark web, Buyucoin has released two official statements on the incident.
Shivam Thakral, the company CEO stated that in the mid of 2020, while conducting a routine testing exercise with dummy data, they faced a ‘low impact security incident’ in which non-sensitive, dummy data of only 200 entries were impacted. They also clarified that not even a single customer was affected during the incident.
He then also published that they are thoroughly investigating each and every aspect of the report about malicious and unlawful cybercrime activities by foreign entities in mid-2020.
Comments