[boo]

In April 2021, Indian brokerage firm Upstox suffered a data breach. The incident exposed extensive personal information on over 100k customers including names, genders, dates of birth, physical addresses, banking information and passwords stored as bcrypt hashes. Extensive "know your customer" information was also exposed including scans of bank statements, cheques and identity documents complete with Aadhaar numbers.



Compromised data: Bank account numbers, Dates of birth, Email addresses, Family members names, Genders, Government issued IDs, Income levels, Marital statuses, Nationalities, Occupations, Passwords, Phone numbers, Physical addresses

Sample:

{"_id":{"$oid":"5e9a9ba2298f54508ccf031f"},"email":"saiakhil9963@gmail.com","lastUpdated":{"$date":"2020-04-18T06:41:10.590Z"},"dateCreated":{"$date":"2020-04-18T06:18:10.167Z"},"lastLoginDate":{"$date":"2020-04-18T06:18:10.167Z"},"source":"Android","isFromAPUrl":false,"utm_params":{},"landingPage":"","leadType":"organicLead","mobile":"9502939240","viewedPreSales":false,"viewedPostSales":false,"txn":{},"sales":{"openStateOfficer":"manish.shah","aadhaar":false,"assignStep":"registration","assignTo":"manish.shah","isAPL":false,"notCalled":true},"personal":{"phone":"9502939240","residency":{"type":"Indian","status":"Status_Resident_Individual","nationality":"Nationality_Indian","nationalityOther":""},"isNameFromIT":true,"ITDown":false,"KRADown":false,"name":"SAI AKHIL SADARAM","nameDeclaration":{"incomeTaxName":"SAI AKHIL SADARAM","bankProof":"SADARAM SAI AKHIL","incomeProof":"","addressProof":"SADARAM SAI AKHIL"},"birthdate":{"date":"21","month":"12","year":"1996"},"iskra":false,"fatherOrSpouseName":"Kesavarao Sadaram","ipvdetails":{"ipvrequire":true,"ipvstatus":"required"},"address":{"correspondence":{"line1":"9-107","line2":"Papayyarajupalem","city":"Sujathanagar","state":"ANDHRA PRADESH","pincode":"530051","proof":""},"permanent":{"line1":"9-107","line2":"Papayyarajupalem","city":"Sujathanagar","state":"ANDHRA PRADESH","pincode":"530051","proof":"","proofOtherText":""},"sameAsCorrespondence":true},"requireddoc":{"ispanrequire":true,"isuidrequire":false,"ischequerequire":false,"isphotorequire":true,"iscoraddressrequire":false,"issignaturerequire":true,"isaddressrequire":true,"isbankstatementrequire":false,"isoptionaldoc":false},"uploadeddoc":{"ispan":true,"isuid":false,"isaddress":true,"isphoto":true,"iscoraddress":false,"ischeque":false,"issignature":true,"isoptionaldoc":false,"isbankstatement":false,"issignaturebmp":true},"docname":{"uid":"","pan":"5e9a9ba2298f54508ccf031f_pan.jpg","photo":"5e9a9ba2298f54508ccf031f_photo.jpg","address":"5e9a9ba2298f54508ccf031f_add.jpg","coraddress":"","cheque":"","bankstatement":"","signature":"5e9a9ba2298f54508ccf031f_sign.jpg","other":"","optionaldoc":""},"gender":"male","maritalStatus":"single","polexposed":"no","tradingExperience":"\u003c 1 Year","income":"below_1L","fatca":{"isTaxResidencyNonIndian":"no","isTaxPayerDeclarationAccepted":true},"occupation":"Student","uploadedrawdoc":{"sign":"5e9a9ba2298f54508ccf031f_raw_sign","add":"5e9a9ba2298f54508ccf031f_raw_add","additional":"5e9a9ba2298f54508ccf031f_raw_additional","pan":"5e9a9ba2298f54508ccf031f_raw_pan","photo":"5e9a9ba2298f54508ccf031f_raw_photo"},"doctype":{"signature":"","add":"uid","pan":"pan","photo":"photo"},"consent":{"signatureUpload":{"isProvided":false}},"additionalDocs":[{"name":"5e9a9ba2298f54508ccf031f_additional_1","clientDocName":"5e9a9ba2298f54508ccf031f_additional_1.jpg","index":1,"linkedTo":"address"}],"isaddressmodified":true},"registrationWorkflowId":5,"currentWorkflowId":2,"targetedSingleSignOn":false,"suiteID":"2b99edb0-4166-0991-d857-5e9a9bf4c096","newUser":true,"__cachedRelations":{"accessTokens":[{"__cachedRelations":{},"__data":{"ttl":3600,"userId":{"$oid":"5e9a9ba2298f54508ccf031f"},"created":{"$date":"2020-04-18T06:18:10.217Z"},"id":"aZbQMH88qWA3TDMTsLtEchFbLLVJXdb71EUysORyxGWLfMjkVhBd3OKJjO5ZpfyD"},"__dataSource":null,"__strict":false,"__persisted":true,"id":"aZbQMH88qWA3TDMTsLtEchFbLLVJXdb71EUysORyxGWLfMjkVhBd3OKJjO5ZpfyD","ttl":3600,"created":{"$date":"2020-04-18T06:18:10.217Z"},"userId":{"$oid":"5e9a9ba2298f54508ccf031f"}}]},"__data":{"email":"saiakhil9963@gmail.com","password":null,"dateCreated":{"$date":"2020-04-18T06:18:10.167Z"},"lastUpdated":{"$date":"2020-04-18T06:18:10.167Z"},"lastLoginDate":{"$date":"2020-04-18T06:18:10.167Z"},"source":"Android","isFromAPUrl":false,"utm_params":{},"landingPage":"","leadType":"organicLead","mobile":"9502939240","viewedPreSales":false,"viewedPostSales":false,"txn":{},"sales":{},"personal":{"phone":"9502939240"},"registrationWorkflowId":5,"currentWorkflowId":5,"targetedSingleSignOn":false,"suiteID":"2b99edb0-4166-0991-d857-5e9a9bf4c096","newUser":true,"id":{"$oid":"5e9a9ba2298f54508ccf031f"}},"__dataSource":null,"__strict":false,"__persisted":true,"firstName":null,"lastName":null,"realm":null,"username":null,"credentials":null,"challenges":null,"emailVerified":null,"verificationToken":null,"status":null,"created":null,"id":{"$oid":"5e9a9ba2298f54508ccf031f"},"password":null,"_scopeMeta":{},"skipPaymentActivated":true,"isPaymentFromLedger":true,"panPageVisited":true,"kra":{"pan":"FYZPS8310F","dob":"21/12/1996","name":"","fatherOrSpouseName":"","agency":"","email":"","mobile":"","address":{"correspondence":{"line1":"","line2":"","city":"","state":"","pincode":"","proof":""},"permanent":{"line1":"","line2":"","city":"","state":"","pincode":"","proof":""}},"gender":"","maritalStatus":"","appStatus":"005","appUpdateStatus":"005","authMode":"0"},"currentStep":"review/email","namePageVisited":true,"options":{"BSE_EQ":true,"NSE_EQ":true,"BCD_FO":false,"NCD_FO":true,"NSE_FO":true,"MCX":true,"MF":true},"pricingPlan":"BASICN1-D0","bank":{"primary":{"ifsc":"IDIB000P182","name":"INDIAN BANK","address":"DOOR NO.13-3 LAKSHMI NARASAYAMMA STREET SUJATHA NAGAR PENDURTHI 530051","branch":"PENDURTHI","city":"PENDURTI","state":"ANDHRA PRADESH","country":"INDIA","micr":"","pincode":"530051","type":"savings","account":"6245103254","accountHolderName":"SADARAM SAI AKHIL"},"impsTransactionCount":1,"isIMPSDone":true},"addressProofConfirmationShown":true,"bankDetailsFailure":false,"brokerageCredit":{"isFreeBrokerageUser":false,"freeBrokerageActivatedAt":{"$date":"2020-06-16T15:22:01.236Z"},"freeBrokerageDeactivatedAt":{"$date":"2020-06-23T17:02:53.286Z"}}}
{"_id":{"$oid":"5ff427e26c817079aad00607"},"email":"dipika.salunkhe15@gmail.com","lastUpdated":{"$date":"2021-01-07T08:42:33.936Z"},"dateCreated":{"$date":"2021-01-05T08:48:34.127Z"},"lastLoginDate":{"$date":"2021-01-06T13:34:17.205Z"},"source":"Android","isFromAPUrl":false,"utm_params":{"utm_campaign":"","utm_content":"","utm_medium":"","utm_source":"","utm_term":"","utm_unique_id":"d3cce748e49163de"},"landingPage":"UPSTOX - INDUSSTOX PAGE","leadType":"organicLead","mobile":"7767917240","viewedPreSales":true,"viewedPostSales":false,"txn":{"L2_R":{"$date":"2021-01-06T10:02:08.779Z"},"L2_R_officer":"kajal.mandve","prevApplicationStatusOnSubmision":"rejected","R_L2":{"$date":"2021-01-06T13:40:40.688Z"},"L2_C":{"$date":"2021-01-06T13:41:38.911Z"},"L2_C_officer":"pranali.gawade"},"sales":{"assignTo":"pritam.jana","openStateOfficer":"pritam.jana","notCalled":false,"aadhaar":false,"assignStep":"payment","isAPL":false,"squadVoiceCampaignId":"6NSF81","callTime":"2021-01-06T13:45:28.868Z","calledMessage":"called and explaine the poress+ usbmitted ","calledStatus":"General_enquiry","iscalled":true,"callCount":null,"reassignTime":{"$date":"2021-01-06T13:49:33.438Z"}},"personal":{"phone":"7767917240","residency":{"type":"Indian","status":"Status_Resident_Individual","nationality":"Nationality_Indian","nationalityOther":""},"isNameFromIT":true,"ITDown":false,"KRADown":false,"originalNameFromIT":"DIPIKA SWAPNIL SALUNKHE","name":"DIPIKA SWAPNIL SALUNKHE","nameDeclaration":{"incomeTaxName":"DIPIKA SWAPNIL SALUNKHE","bankProof":"Dipika swapnil salunkhe","incomeProof":"DIPIKA SWAPNIL SALUNKHE"},"birthdate":