Login
iscover
Share this article on:
Powered by
MOMENTUM
MEDIA
Powered by MOMENTUMMEDIA
A data breach of an Indian car rental and ridesharing company has exposed the data of millions of users after an unauthorised user gained access.
ZoomCar is an Indian peer-to-peer car-sharing company that allows car owners to list their vehicles for short- and medium-term rental. It operates in multiple markets in Asia and became a US-listed public company after it merged with Innovative International Acquisition Corp (IOAC) in late 2023.
Being a US listed company, it was required to disclose the cyber incident to the US Securities and Exchange Commission (SEC).
“On June 9, 2025, Zoomcar Holdings, Inc. (the ‘company’) identified a cyber security incident involving unauthorised access to its information systems,” the company said in an SEC filing.
“The company became aware of the incident after certain employees received external communications from a threat actor alleging unauthorised access to company data. Upon discovery, the company promptly activated its incident response plan.”
Based on its initial investigation, ZoomCar said the threat actor accessed a “limited dataset containing certain personal information of a subset of approximately 8.4 million users, including names, phone numbers, car registration numbers, personal addresses and email addresses associated with such users”.
“At this time, there is no evidence that financial information, plaintext passwords, or other sensitive identifiers were compromised,” it said.
ZoomCar said it is still investigating and has not yet determined the nature or full impact of the incident.
Cyber Daily has not observed any threat actors or ransomware groups claiming responsibility for the attack.
This is the second cyber incident that ZoomCar has suffered after it was breached in 2018.
In the earlier incident, the data of over 3.5 million individuals was exposed, including names, emails, phone numbers, IP addresses and passwords stored as bcrypt hashes.
The data was then listed for sale in 2020 on a cyber crime marketplace. It is unclear if it was sold.
Be the first to hear the latest developments in the cyber industry.
