Siddhagiri Naturals

On May 18, 2024, we observed a significant data leak originating from the Indian e-commerce platform, Siddhagiri Naturals. The discovery was made through routine monitoring of dark web marketplaces and illicit sharing channels. What struck us immediately was the inclusion of bcrypt hashed passwords, indicating a more sophisticated attacker than one merely seeking readily exploitable credentials. The sheer volume of personally identifiable information (PII) alongside these hashed passwords suggests a deliberate effort to build comprehensive user profiles for potential downstream attacks.

The breach, impacting approximately 17,000 records, was identified as a database compromise. The exposed data encompasses a broad spectrum of user information, including 3,186 unique email addresses, first and last names, phone numbers, and physical addresses. Crucially, the dataset also contains bcrypt hashed passwords, a strong cryptographic hashing function that, while not plaintext, can be vulnerable to brute-force or dictionary attacks if weak passwords are used. The source structure of the leaked data appears to be a direct database dump, likely exfiltrated via SQL injection or compromised database credentials. The leak was subsequently disseminated via a prominent Telegram channel, increasing its accessibility to a wider audience of malicious actors.

While there is no immediate widespread news coverage for this specific incident, the nature of the leaked data aligns with a growing trend of e-commerce platforms being targeted for their rich user databases. Similar breaches involving hashed passwords have been reported globally, often leading to credential stuffing attacks against other online services. Researchers have consistently highlighted the importance of robust password policies and the implementation of multi-factor authentication to mitigate the impact of such data exposures, even when passwords are not in plaintext.