Bharat Sanchar Nigam Limited

We've been tracking an uptick in data breaches targeting Indian government entities and state-owned enterprises. What really struck us wasn't just the volume of exposed data, but the apparent ease with which it was obtained and the speed with which it appeared on various dark web marketplaces. This latest incident involving **Bharat Sanchar Nigam Limited (BSNL)**, a major Indian state-owned telecommunications company, fits this worrying pattern. The data had been circulating quietly for a few weeks, but we noticed a surge in chatter across multiple Telegram channels and Breach Forums, prompting a deeper investigation. The setup here felt different because the exposed data wasn't just usernames and passwords but also detailed employee information.

### BSNL Breach: 2.4M Employee Records Exposed on Dark Web Forums

A significant data breach has impacted **Bharat Sanchar Nigam Limited (BSNL)**, resulting in the exposure of approximately **2.4 million employee records**. The breach was first discovered on several dark web forums and Telegram channels in late **May 2024**, with increased chatter drawing our attention to it in early **June**. What caught our attention was the detailed nature of the information exposed, going beyond typical credentials to include sensitive personal and professional data. This incident is particularly concerning for enterprises due to the potential for identity theft, phishing attacks, and other malicious activities targeting BSNL employees. The breach underscores the persistent threat of data exfiltration from large organizations and its subsequent dissemination across illicit online platforms. It also highlights the vulnerability of critical infrastructure to cyberattacks, a theme we've observed repeatedly in recent months.

**Breach Stats:**

* **Total records exposed:** Approximately 2.4 million
* **Types of data included:** Employee names, employee IDs, job titles, email addresses, phone numbers, addresses (both residential and official), salary information, and other sensitive employee data.
* **Sensitive content types:** PII (Personally Identifiable Information), salary details.
* **Source structure:** The data appears to be extracted from internal databases and presented in a structured format, possibly a combination of SQL exports and CSV files.
* **Leak location(s):** Telegram channels, Breach Forums.

The breach has already garnered attention within the cybersecurity community. One popular Telegram channel, observed by our team, explicitly advertised the availability of the BSNL employee database, claiming it contained "verified contact details and sensitive employment information." Another forum user posted samples of the data, further validating the breach's authenticity.

While BSNL has yet to release an official statement regarding the breach, news outlets are beginning to pick up the story. Initial reports suggest that the data was likely exfiltrated through a combination of social engineering and potentially unpatched vulnerabilities in BSNL's internal systems.