Overview

• Discovery on June 9 followed threat actor emails to employees and triggered the company’s incident response protocol.
• Preliminary investigation found that the breach exposed names, phone numbers, car registration numbers, home addresses and email addresses for 8.4 million users.
• Zoomcar says there is no evidence that financial information, plaintext passwords or other sensitive identifiers were accessed.
• The company has filed a report with the SEC, notified regulatory and law enforcement bodies, and is cooperating with their inquiries but has not disclosed if it has alerted affected customers.
• The incident marks Zoomcar’s second major breach after a 2018 attack compromised over 3.5 million customer records.