Search

Tracker / India

Data breaches in India, 2026

Data breaches and cyberattacks affecting Indian organisations and users in 2026 — each with our own sourced report.

DisclosedOrganisationSectorCountryRecordsCause / actorStatus
Dodo PaymentsBengaluru payments firm said attackers used a Metabase flaw to reach an internal analytics system holding some merchant data; a dark-web listing claims more.Read our reportFinanceIndiaUnknownVulnerabilityConfirmed
Bank of BarodaBank disclosed a cyber incident linked to a possible business email compromise after an anonymous claim of data access; ~1TB leak claims are unverified.Read our reportFinanceIndiaUnknownSocial engineeringConfirmed
Reliance Infrastructure (Kudankulam project data)Reliance confirmed a 'partial breach' of a Yotta-hosted server after files tied to Kudankulam nuclear plant work appeared on a leak site.Read our reportOtherIndiaUnknownData theftWorld LeaksConfirmed
UMANG (MeitY government services app)Researchers found flaws exposing EPFO UANs, LPG bookings and plaintext Aadhaar numbers via linked services; MeitY said data in affected APIs is now encrypted.Read our reportGovernmentIndiaUnknownVulnerabilityConfirmed
National Testing Agency (CUET-UG 2026 candidate data)MediaNama found about 15.5 lakh CUET-UG 2026 candidate records offered for sale; NTA says it shares data only via DigiLocker and authorised APIs. Origin unclear.Read our reportEducationIndia1.6M (seller's claim)UnknownClaimed
IDRBT (.bank.in domain registry)Unauthenticated APIs in the RBI-mandated .bank.in registrar exposed data on 5,576 bank staff for 13+ months; CERT-In said the issue was fixed.Read our reportFinanceIndia5.6KVulnerabilityConfirmed
Bajaj AutoAutomaker told stock exchanges ransomware hit its systems and tech subsidiary; operations continued and it did not say if data was taken.Read our reportManufacturingIndiaUnknownRansomwareConfirmed
Tata ElectronicsApple and Tesla supplier confirmed a cyber incident after ~630GB (204,000+ files) of alleged company data was posted online.Read our reportManufacturingIndiaUnknownData theftWorld LeaksConfirmed
UltrahumanWearables maker told users in June that credentials stolen from an employee laptop gave read-only access to contact, purchase and fitness data on 27 March.Read our reportTechnologyIndiaUnknownData theftConfirmed
CBSE (On-Screen Marking portal)Student researchers showed admin access to CBSE's marking portal; CBSE said on 26 May it was a test site, then on 1 June that the vulnerabilities were contained.Read our reportEducationIndiaUnknownVulnerabilityConfirmed
HDFC Asset Management CompanyFund house reported a cyber incident found 16 May; Bombay HC barred use of data the Morpheus group claims to hold. HDFC AMC has not confirmed data loss.Read our reportFinanceIndiaUnknownUnknownMorpheus (claimed)Confirmed
Bhavnagar District Co-operative BankPolice say the accused changed mobile numbers linked to four accounts and pushed ~1,170 NEFT transfers, siphoning ₹7.34 crore; ₹2.04 crore frozen.Read our reportFinanceIndiaUnknownVulnerabilityConfirmed
DavaIndia Pharmacy (Zota Healthcare)Insecure admin APIs exposed ~17,000 online orders and control of 883 stores, a researcher disclosed in February; the flaw was fixed in 2025 after a CERT-In report.Read our reportHealthcareIndiaUnknownVulnerabilityConfirmed

How reporting works in India: CERT-In's 6-hour rule and the DPDP breach duties, explained. Victims can report at cybercrime.gov.in or call 1930.

All 2026 breaches