Biggest Cyber Breaches in India

Year-by-Year Breakdown of Major Cyber Incidents in India

A quick snapshot of how cyber threats have evolved across industries - showing the scale, frequency, and impact of major attacks from 2019 to 2025. This timeline helps you see how each year brought new patterns, bigger targets, and sharper lessons for businesses.

2019

Major Financial Data Exposure (January 2019)

In early 2019, a major financial institution left one of its servers unprotected, without even a basic password. This server stored millions of SMS alerts that were routinely sent to customers, containing balance updates and transaction summaries. Because of the oversight, anyone who discovered the server could view more than three million such messages, highlighting a serious lapse in fundamental security practices.

Large-Scale User Information Leak (April 2019)

A leading local search platform faced a massive data leak after personal information of over 100 million users became publicly accessible. The exposed data breach included names, mobile numbers, email IDs, dates of birth, gender, and complete addresses. A security researcher discovered the unsecured database and posted details about the breach online, sparking a national discussion about data safety.

Healthcare Database Compromised (August 2019)

A cybersecurity firm disclosed that nearly 6.8 million patient and doctor records from an Indian healthcare service had been stolen. The data was traced to an advanced foreign hacking group known for selling sensitive information on the dark web. Medical histories and personal identifiers reportedly appeared online for prices around USD 2,000 per dataset.

2020

EdTech User Records Breach (May 2020)

A widely used e-learning platform admitted that details of 22 million users were compromised. A threat intelligence firm later confirmed that the stolen information, usernames, email IDs, and hashed passwords had been listed for sale on the dark web. The incident triggered internal security reviews across the edtech sector.

Online Retail Customer Data for Sale (October 2020)

A major online grocery service saw its customer database surface on an underground cybercrime forum. Nearly 20 million user records were offered for USD 40,000. These records contained names, contact details, IP addresses, and other personal identifiers. A cybersecurity team verified the authenticity of the leaked sample before notifying the organisation.

2021

Payment Platform Breach (January 2021)

An online payments processor suffered a breach that exposed masked card details and digital fingerprints of 35 million users. The attackers reportedly gained access by exploiting an unrecycled access key. Soon after, the stolen dataset appeared on the dark web for a relatively low price, suggesting the attackers sought quick monetisation.

COVID-19 Test Report Leak (January 2021)

Roughly 1,500 COVID-19 test results of Indian citizens became publicly visible on the internet, not due to hacking but because the files were inadvertently indexed by search engines. These PDF reports, hosted on official government domains, included names, dates of birth, testing dates, and centre information. Investigators later determined that improper access controls on the health portals caused the exposure.

Police Recruitment Data Leak (February 2021)

A threat intelligence organisation detected personal details of more than half a million police exam applicants being traded online. The information included phone numbers, birth dates, email addresses, and even criminal background details. A sample was circulated for verification, and the data was eventually traced back to a recruitment exam conducted in 2019.

Trading Platform KYC Breach (April 2021)

A major trading and investment platform reported that user KYC documents stored with a third-party vendor may have been compromised. The platform proactively reset passwords for all affected users and strengthened its security protocols, including expanding its bug bounty program to identify vulnerabilities early.

Food Delivery Order Records Leak (April 2021)

In another high-impact incident, data linked to over 180 million food delivery orders was put up for sale on the dark web. The attackers claimed possession of around 13 terabytes of information, including customer details and historic order logs, and demanded cryptocurrency in exchange.

Airline Passenger Information Breach (May 2021)

A global aviation IT provider revealed that personal data belonging to 4.5 million passengers of several airlines had been compromised. The breach impacted records collected over nearly a decade. Affected passengers were informed months after the incident due to the complexity of the investigation.

2022

Utility Services Data Exposure (2022)

A prominent public-sector utility experienced a major breach when financial transaction logs, internal documents, and portions of its customer records surfaced on hacker forums. The attackers exploited outdated software components, prompting the organisation to overhaul its security framework.

Telecom Customer Information Leak (2022)

One of the year’s most significant telecom-related incidents occurred when millions of call logs, device details, and customer contact information appeared online. Early investigations pointed to an unprotected API endpoint that allowed attackers to retrieve large volumes of data without authentication.

National Healthcare Booking System Breach (2022)

A central medical appointment platform suffered a breach that exposed patient IDs, appointment details, and associated personal information. Weak login and verification controls enabled the attackers to bypass the system and download large datasets undetected.

2023

Insurance Sector Data Compromise (2023)

A leading player in the insurance technology space reported that internal files, policyholder information, and financial records had been accessed by unauthorised actors. Preliminary investigations suggested compromised employee credentials as the root cause. The incident reaffirmed the importance of strong authentication measures.

EdTech Analytics Leak (2023)

An online learning platform faced a breach in which student activity data, login details, and analytics reports were accessed. While no financial information was involved, the leak highlighted privacy concerns around behavioural tracking and storage of learning patterns.

Transport Infrastructure Cyber Disruption (2023)

A significant attack targeted backend systems of a major transport infrastructure network, affecting operational schedules and internal communication channels. Although there was no direct safety risk, the incident underscored growing vulnerabilities in operational technology systems across India.

2024

Financial Services Cloud Misconfiguration (2024)

A major financial platform faced a breach when attackers exploited misconfigured cloud storage to access transaction metadata and partial KYC information. The event triggered a broader discussion on cloud governance and secure configuration practices across the BFSI sector.

Government Identity Records Exposure (2024)

In mid-2024, a misconfigured government database inadvertently made thousands of identity-related entries publicly accessible. Though the exposure was quickly contained, it sparked renewed criticism about safeguards in centralised citizen-data repositories.

Diagnostic Services Platform Attack (2024)

A national diagnostic network faced a sophisticated breach that exposed medical reports, billing records, and internal communication logs. Industry experts noted the complexity of the attack, marking it as one of the year’s most impactful healthcare-related cyber incidents.

2025

E-Commerce Data Dump (2025)

A major e-commerce platform experienced a large-scale data dump involving customer addresses, purchase histories, and partial payment information. The attackers used credential-stuffing attacks, leveraging reused passwords from unrelated breaches, to infiltrate user accounts.

Manufacturing Sector Ransomware Attack (2025)

A leading industrial manufacturing group was hit by a disruptive ransomware attack that halted production lines and exposed internal files, supplier contracts, and process documentation. The breach highlighted how cyberattacks are increasingly impacting physical operations.

Transport Ticketing System Intrusion (2025)

A digital ticketing ecosystem for public transport reported a cyber intrusion that compromised commuter information, trip logs, and transaction references. Authorities conducted a full forensic review and enforced multi-factor authentication upgrades to prevent future attacks.

Why Stronger Cybersecurity & Insurance Strategies Are Now More Essential Than Ever?

With cyberattacks becoming more targeted, complex, and costly, Indian businesses can no longer depend on surface-level cybersecurity measures. Threat actors now exploit supply chains, cloud misconfigurations, third-party weaknesses, and even everyday employee errors, turning small gaps into full-blown crises. A single incident can halt operations, expose customer data, trigger regulatory penalties, and erode brand trust built over years.

This changing threat environment makes it critical for organisations to strengthen both their cybersecurity posture and their financial resilience. Robust defence systems help prevent and contain breaches, while Cyber Insurance ensures that when an attack does occur, businesses have the support to recover swiftly, covering legal costs, forensic investigations, business interruption losses, and more. Together, they create a stronger, more future-ready shield against the evolving cyber risks of today.

Conclusion

The events outlined from 2019 to 2025 reinforce a simple reality: cyber risk is universal. As more services move online and digital dependencies deepen, vulnerabilities become harder to avoid.

To remain secure, organisations must strengthen their defences through timely updates, better access controls, continuous monitoring, and employee awareness, supported by cyber insurance to manage financial and legal exposure. In the long run, resilience comes from readiness, not reaction