Rentomojo informs customers about cyber attack, says their financial data is safe

“Recently, our team identified a security breach that involved unauthorised access to one of our databases,” founder Geetansh Bamania said in an email to customers. He said that the company has initiated an investigation and has engaged leading cybersecurity and legal experts to assist the firm.

ET has reviewed a copy of the email sent to customers.

“It appears that the attackers were able to get unauthorised access to our customer data, including in some cases personally identifiable information, by exploiting the cloud misconfiguration through extremely sophisticated attacks, thus breaching one of our databases,” Bamania wrote.

‘Financial information not impacted’
The Rentomojo founder added that there would be no impact on any financial information, such as credit cards, debit cards or UPI details, as the company does not store this information.

Bamania confirmed the development to ET but did not disclose the scale of the breach or reveal what kind of information had been accessed.

“Our team identified a security breach that involved unauthorised access to one of our databases,” he said. “We have reported this incident to the appropriate authorities and are cooperating fully with the ongoing investigation.”

Thousands may be affected
On its website, the company said it has about 150,000 customers. A number of customers have also taken to social media after receiving the email from the company.

Rentomojo joins a list of other high-profile targets, including payments app Mobikwik, grocery e-tailer Big Basket, educational technology platform Unacademy and payment aggregator JusPay that have suffered massive data breaches in recent years.

Mobkiwik’s data breach in 2021 was considered to be the biggest such cyberattack in Indian history, leading the Reserve Bank of India to intervene as over 10 crore users had been affected.

In 2020, the personal data of over 20 million BigBasket users was put on the dark web, including their names, email ids, addresses and phone numbers.