How a Hacking Forum Post Led to the Flipkart 2022 Leak of 1.4 Million Records

HEROIC analysts identified a large-scale customer data leak tied to Flipkart, a major Indian e-commerce platform, surfacing on a public hacking forum on September 2, 2022. The dataset contained approximately 1,479,370 unique customer records. The occured exfiltration focused on personally identifiable information: email addresses, first names, last names, and phone numbers, with no passwords included in this particular dump.

Why Personal Data Without Passwords Is Still Dangerous

Many people assume that a breach without password data is lower risk. That assumption is wrong. A combination of a real name, email address, and phone number is partcularly valuable for targeted phishing, SIM-swap fraud, and social engineering attacks. Criminals use this kind of clean PII to craft convincing impersonation scams, contact victims directly via phone, or build profiles for larger identity theft operations.

What Was Exposed in the Flipkart 2022 Breach

• Email Address
• Phone Number
• First Name
• Last Name

How 1.4 Million Records Enable Large-Scale Fraud

When over a million customer profiles are compiled into a single dataset, the risk is not just individual. Automated fraud systems can send mass phishing emails personalized with the victim's real name, call or text phone numbers with scam offers, and cross-reference the data against other leaked databases to build richer profiles. Recieved PII from e-commerce platforms is consistently among the most traded data on criminal markets because it targets real, active shoppers with verified contact details.

How a Database Breach Works

A database breach occurs when an attacker gains unauthorized access to a company's stored user records, often by exploiting a vulnerability in the web application, abusing poorly secured API endpoints, or using compromised internal credentials. Customer tables can be extracted in bulk and structured for easy distribution. The resulting dataset is then posted to hacking forums or sold in private criminal channels, where it remains in circulation long after the original breach date.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches more than 400 billion compromised records to determine whether your email address appeared in the Flipkart 2022 breach or any other known data leak. Run a free check at HEROIC.com and see exactly what information about you is already out there.