Delivery App Users Exposed: 3.45 Million Dunzo Accounts Leaked

HEROIC analysts traced a dataset tied to Dunzo, the India-based on-demand delivery service, to a Telegram channel where it surfaced on June 19, 2020. The dataset contains 3,458,441 records, each pairing a user's email address, phone number, first and last name, and IP address. No passwords were included in this particular leak, but the volume and personal detail involved still make it a serious exposure for anyone who used the app.

Why This Is Dangerous

Millions of Dunzo customers, many of whom trusted the app with their contact details through delivery requests, phone numbers, and full names, now have that information sitting in a dataset shared on Telegram. An attacker doesn't need a password to cause harm here. A real name, phone number, and email together are enough to run a convincing phishing or SMS scam that looks like it's coming from Dunzo itself, or from a bank, delivery company, or government agency the victim already trusts.

What Was Exposed

• Email addresses
• Phone numbers
• First and last names
• IP addresses

Why This Matters

Phone numbers and names from a leak like this regularly end up used in SIM-swap attempts and targeted phishing texts, sometimes called smishing, where the message references a real order or account to seem legitimate. IP addresses can also be used to roughly locate a person or tie an account to a specific device or network, adding another layer of detail attackers can use to make their approach more convincing.

How Database Breaches Work

This incident is classified as a database breach, meaning the data was pulled directly from Dunzo's backend systems rather than harvested one login at a time. Attackers who find a way into a company's database, whether through a software vulnerability, a stolen employee credential, or a misconfigured server, can walk away with millions of records in a single action. That's why database breaches like this one tend to produce such large numbers so quickly.

Check If You Are Affected

If you've ever used Dunzo or share an email address and phone number across several apps, it's worth checking whether your information shows up here. HEROIC's free breach scanner searches more than 400 billion leaked records so you can find out in seconds and take steps, like watching for suspicious calls or texts, before anyone tries to use your data against you.