Loading story…
An Indian data-brokerage operation allegedly offers unauthorized access to KYC-linked personal records through a public Telegram bot and a business API platform. Its catalog reportedly includes identity, financial, employment, telecommunications, and vehicle-registration data, creating a low-cost channel for identity theft, fraud, targeted phishing, and doxxing.
Prices reportedly range from INR 5 to INR 700 (about USD 0.06–8.00) per lookup. A vehicle-registration query costing INR 5 allegedly returns the registered owner’s full name, father’s name, current and permanent addresses, postal code, and mobile number, demonstrating the breadth of personally identifiable information exposed through the service.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
An Indian data-brokerage operation was reported to offer unauthorized access to identity, financial, employment, telecommunications, and vehicle-registration records through a public Telegram bot and business API platform. Records were reportedly priced from INR 5 to INR 700, with a vehicle lookup returning the registered owner's personal and contact details.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A new online tool and Telegram bot called Proxyearth has emerged, enabling anyone to obtain highly sensitive personal information about Indian citizens using only their mobile phone number. Testing by security researchers confirmed that the tool provides accurate and up-to-date details, including full name, father's name, email address, telecom provider, home address, alternate phone numbers, and even Aadhaar card numbers. The service, launched in October 2025, appears to aggregate data from previously breached KYC records, leaked Aadhaar databases, and other state-linked sources, raising significant privacy and security concerns. The existence of Proxyearth poses a severe threat to national security, as it allows for large-scale surveillance, profiling, and potential targeting of individuals, including government officials, law enforcement, and journalists. The tool's ability to pinpoint exact locations and expose comprehensive identity information highlights the ongoing risks associated with massive data breaches in India and the exploitation of sensitive government and telecom records. Authorities are being urged to investigate the source of the data and take immediate action to mitigate the threat posed by this tool.
Jun 29, 2026
India’s `.bank.in` domain program, launched to improve trust in banking websites and reduce phishing, was hit by allegations that the registration portal run by the Institute for Development and Research in Banking Technology (IDRBT) exposed sensitive data through more than **33 unauthenticated REST API endpoints**. Researcher **Srikanth L** of CashlessConsumer reported that the flaws could have exposed information tied to **5,576 bank employees** responsible for managing banking domains, including **bcrypt password hashes**, mobile numbers, email addresses, login IP addresses, and device fingerprints. The reported exposure raised concerns that attackers could use the leaked information for impersonation, phishing, and DNS-related attacks against Indian banks. The researcher said the portal remained insecure for about **13 months** and lacked a proper security audit, while many `.bank.in` domains were also found to have weak security hygiene, including limited adoption of **DNSSEC** and **DMARC** and, in some cases, hosting on shared international servers. IDRBT reportedly fixed the exposed API flaws after disclosure, while public responses from IDRBT, the Reserve Bank of India, and the Indian government were not available at the time of reporting.
Jun 30, 2026
Indian online grocer **BigBasket** was linked to a major data exposure after a threat actor advertised a database allegedly containing details of roughly **20 million users** for sale on the dark web. Reporting said the records included customer information such as names, email addresses, phone numbers, physical addresses, dates of birth, password hashes, and IP addresses, raising concerns about follow-on phishing, account takeover, and identity fraud affecting a large portion of the company’s customer base. The incident later escalated when the same alleged **BigBasket** dataset was reportedly released for free, making the information broadly accessible rather than limited to a private sale. The leak significantly increased the potential impact of the breach by lowering the barrier for cybercriminals to reuse the data in credential attacks and targeted scams, while intensifying scrutiny of the company’s security posture and breach response.
Jul 12, 2026