Zoomcar, traded on Nasdaq, reveals data breach impacting 8.4 million users in India

Zoomcar, a company that operates a car-sharing business, has disclosed that a hacker managed to gain access to the personal information of over 8.4 million customers in India. This data breach was reported to the U.S. Securities and Exchange Commission owing to the fact that Zoomcar became a publicly traded business in Delaware after merging with IOAC, an American blank-check firm, in late 2023. Consequently, its shares are traded on the Nasdaq stock exchange, and on Monday, the share price experienced a decline of 12.3%. Established in 2013 by two Americans, Zoomcar offers the facility to rent cars on a monthly, weekly, daily, and hourly basis in 99 cities across India. The company boasts having more than 25,000 vehicles and accommodating over 10 million users, as evidenced by their investor website.

It was reported that the breach occurred on June 9, as stated in the filing made on Friday. Zoomcar, headquartered in Bangalore, became aware of the incident after some staff members were subjected to external communications from a malicious actor, affirming unauthorized access to the company’s data files. Promptly reacting to this security incident, the company activated its predefined incident response measures.

Following an initial probe into the matter, the company concluded that an unauthorized third party managed to access a limited cache of data encompassing specific personal details of around 8.4 million users. This information compromised names, phone numbers, vehicle registration numbers, home addresses, and email addresses linked to these users. Fortunately, the investigation did not reveal the compromise of any financial data, plaintext passwords, or other significant identifiers.

Zoomcar has since bolstered its security systems by rolling out additional safeguards throughout its cloud and internal network. These measures also encompass enhanced system monitoring and a thorough revision of access controls, as indicated in the filing with the SEC. The company has engaged external cybersecurity professionals to collaborate on the ongoing investigation. Additionally, law enforcement and regulatory bodies have been notified, and the company is cooperating fully with their investigations.

Formerly, Zoomcar faced a data breach in 2018 that exposed the records of over 3.5 million customers. Subsequently, this data was made available for sale on an underground market in 2020. In the U.S., other car-sharing firms such as Zipcar, which is under the umbrella of Avis Budget Group, and Enterprise CarShare, affiliated with Enterprise Rent-A-Car, offer similar services. Turo, however, is privately owned by a consortium of investors.

Venezuela currently records the highest number of refugees and individuals seeking international protection globally, based on the latest Global Trends report produced by the U.N. High Commissioner for Refugees. Notably, Lebanese officials have expressed their resolve to prevent entanglement in the ongoing conflict between Israel and Iran, as the country recuperates from the recent Israel-Hezbollah clash. President Trump embarked on a G7 meeting in Canada, navigating pressing concerns such as trade agreements and the Israel-Iran standoff with his contemporaries. The government in Ecuador, led by President Daniel Noboa, recently secured legislative backing for two integral laws intended to fortify their responses to escalating organized crime and violence in the region. Lastly, the strife between Israel and Iran continues to escalate, with four consecutive days of retaliatory strikes damaging residential buildings in central Israel.