Search

Tracker / India

Data breaches in India, 2026

Data breaches and cyberattacks affecting Indian organisations and users in 2026 — each with our own sourced report.

19 incidents17 confirmedLatest 21 Oct 2026

By sector: Finance 7 · Government 2 · Other 2 · Healthcare 2 · Education 2 · Manufacturing 2 · Retail 1 · Technology 1. By cause: Unknown 7 · Vulnerability 6 · Data theft 4 · Social engineering 1 · Ransomware 1.

DisclosedOrganisationSectorCountryRecordsCause / actorStatus
State Bank of IndiaSBI told exchanges 3,897 customer records with names, mobiles, dates of birth and addresses were found in ~3.75 lakh records on the dark web; source unknown.Read our reportFinanceIndia3.9K (bank's filing)UnknownConfirmed
RapiPay FintechNoida fintech told police ₹1.56 crore left its Yes Bank account in 43 transfers in 23 minutes on 3 Oct via a field agent's app; FIR filed.Read our reportFinanceIndiaUnknownUnknownConfirmed
West Bengal State Data CentreMedia reports citing unnamed sources say malware hit the state data centre on 9–13 Sep, taking portals offline; the state has not confirmed it.Read our reportGovernmentIndiaUnknownUnknownClaimed
Gujarat Mineral Development Corporation (GMDC)Gujarat state miner told exchanges CERT-In flagged a probable data breach linked to its website; it is investigating and says core systems are unaffected.Read our reportOtherIndiaUnknownUnknownConfirmed
Cars24Used-car platform told police about 3,100 customer records were taken between March and August and sold to a rival; an FIR names five people.Read our reportRetailIndia3.1K (company's complaint)Data theftConfirmed
Vimta LabsHyderabad testing and research lab told exchanges it detected a cyber incident in part of its IT systems; operations unaffected, root cause under review.Read our reportHealthcareIndiaUnknownUnknownConfirmed
Dodo PaymentsBengaluru payments firm said attackers used a Metabase flaw to reach an internal analytics system holding some merchant data; a dark-web listing claims more.Read our reportFinanceIndiaUnknownVulnerabilityConfirmed
Bank of BarodaBank disclosed a cyber incident linked to a possible business email compromise after an anonymous claim of data access; ~1TB leak claims are unverified.Read our reportFinanceIndiaUnknownSocial engineeringConfirmed
Reliance Infrastructure (Kudankulam project data)Reliance confirmed a 'partial breach' of a Yotta-hosted server after files tied to Kudankulam nuclear plant work appeared on a leak site.Read our reportOtherIndiaUnknownData theftWorld Leaks (claimed)Confirmed
UMANG (MeitY government services app)Researchers found flaws exposing EPFO UANs, LPG bookings and plaintext Aadhaar numbers via linked services; MeitY said data in affected APIs is now encrypted.Read our reportGovernmentIndiaUnknownVulnerabilityConfirmed
National Testing Agency (CUET-UG 2026 candidate data)MediaNama found about 15.5 lakh CUET-UG 2026 candidate records offered for sale; NTA says it shares data only via DigiLocker and authorised APIs. Origin unclear.Read our reportEducationIndia1.6M (seller's claim)UnknownClaimed
IDRBT (.bank.in domain registry)Unauthenticated APIs in the RBI-mandated .bank.in registrar exposed data on 5,576 bank staff for 13+ months; researchers say CERT-In confirmed the fix.Read our reportFinanceIndia5.6KVulnerabilityConfirmed
Bajaj AutoAutomaker told stock exchanges ransomware hit its systems and tech subsidiary; operations continued and it did not say if data was taken.Read our reportManufacturingIndiaUnknownRansomwareConfirmed
Tata ElectronicsApple and Tesla supplier confirmed a cyber incident after ~630GB (204,000+ files) of alleged company data was posted online.Read our reportManufacturingIndiaUnknownData theftWorld Leaks (claimed)Confirmed
UltrahumanWearables maker told users in June that credentials stolen from an employee laptop gave read-only access to contact, purchase and fitness data on 27 March.Read our reportTechnologyIndiaUnknownData theftConfirmed
CBSE (On-Screen Marking portal)Student researchers showed admin access to CBSE's marking portal; CBSE said on 26 May it was a test site, then on 1 June that the vulnerabilities were contained.Read our reportEducationIndiaUnknownVulnerabilityConfirmed
HDFC Asset Management CompanyFund house reported a cyber incident found 16 May; Bombay HC barred use of data the Morpheus group claims to hold. HDFC AMC has not confirmed data loss.Read our reportFinanceIndiaUnknownUnknownMorpheus (claimed)Confirmed
Bhavnagar District Co-operative BankPolice say the accused changed mobile numbers linked to four accounts and pushed ~1,170 NEFT transfers, siphoning ₹7.34 crore; ₹2.04 crore frozen.Read our reportFinanceIndiaUnknownVulnerabilityConfirmed
DavaIndia Pharmacy (Zota Healthcare)Insecure admin APIs exposed ~17,000 online orders and control of 883 stores, a researcher disclosed in February; the flaw was fixed in 2025 after a CERT-In report.Read our reportHealthcareIndiaUnknownVulnerabilityConfirmed

Confirmed = the organisation or a regulator has confirmed it. Claimed = reported claim, not yet confirmed.

Data breaches in India: quick answers

How many data breaches were reported in India in 2026?

This tracker lists 19 notable data breaches and cyberattacks affecting Indian organisations disclosed in 2026, the latest on 21 October 2026. 17 were confirmed by the organisation or a regulator; 2 rest on an attacker's or seller's claim. It covers incidents with public, checkable sources, not every breach in India.

Which Indian organisations had a data breach in 2026?

Confirmed incidents in this tracker include State Bank of India (21 Oct 2026), RapiPay Fintech (07 Oct 2026), Gujarat Mineral Development Corporation (04 Sep 2026), Cars24 (04 Sep 2026), Vimta Labs (21 Aug 2026), Dodo Payments (17 Aug 2026), Bank of Baroda (28 Jul 2026), Reliance Infrastructure (16 Jul 2026). Each entry links to our report with its sources.

What should I do if my data was in a breach?

Change the password for that service and anywhere you reused it, turn on two-step verification, and expect phishing calls and messages that quote your real details. Never share an OTP. Our guide to what to do after a data breach notice has the full steps, and if money is taken, call 1930.

Do companies in India have to report data breaches?

Yes. Under CERT-In's directions of 28 April 2022, organisations must report cyber incidents, including data breaches, to CERT-In within six hours of noticing them. Under the DPDP Rules, 2025, notice to the Data Protection Board and to affected people starts in May 2027. Our explainer covers both.

Victims can report at cybercrime.gov.in or call 1930. Spotted a missing breach? Tell the desk.

All 2026 breaches