NowZone

We noticed a recent data leak surfacing on a prominent hacking forum on August 4th, 2024, attributed to the Indian e-commerce platform, NowZone. What struck us was the relatively small scale of the incident, impacting approximately 6,775 unique records, yet encompassing a comprehensive set of personally identifiable information (PII) and credentialing data. The availability of bcrypt-hashed passwords, while a positive security measure, still presents a significant risk when coupled with other exposed attributes. This incident serves as a reminder that even smaller platforms can become targets, and the impact of a breach is not solely determined by the number of records compromised.

The breach, discovered through routine monitoring of dark web marketplaces and hacking forums, appears to stem from a direct database compromise. The exposed data set includes 6,775 records, each containing a user's Email Address, Password Hash (bcrypt), Phone Number, First Name, Last Name, Gender, and Birthday. The structured nature of the leak suggests a direct exfiltration from a primary customer database. The threat theme here is clearly credential stuffing and identity theft, as the combination of email, hashed password, and extensive PII provides attackers with ample ammunition for further targeted attacks or account takeovers on other platforms. The leak location was identified as a well-known hacking forum, indicating a deliberate act of public disclosure by the threat actor.

While there has been no widespread media coverage of this specific NowZone breach, it aligns with a broader trend of smaller e-commerce platforms in emerging markets becoming targets for data theft. Similar incidents, though often larger in scale, have been reported involving regional online retailers, highlighting vulnerabilities in their security postures. Open-source intelligence (OSINT) searches reveal NowZone as an established player in the Indian e-commerce landscape, suggesting a potentially significant user base, even if the breached subset is limited. Further research into common attack vectors targeting such platforms could offer valuable insights into how this compromise may have occurred.