Earlier in July, Dunzo confirmed a massive data breach in which personal information of users such as the mobile number and email address was exposed. Fresh updates on the beach are coming from Dunzo now. In an internal investigation, the delivery service provider discovered that information compromised contained additional Personally Identifiable Information (PII) data as well.
Dunzo explained that affected information included details such as the last known location, phone type, last login dates. The company further found that the database also contained advertising-related attributes including a few specific PII — device info, last known IP address, and advertising id. Earlier the company confirmed that phone numbers and email addresses of users were exposed.
Sticking to its past claims Dunzo has further clarified that payment information like credit cards is not stored on Dunzo servers and hence is not at risk. So, users must know that no financial or payment details have been affected by the breach.
The delivery service provider explained that the servers of a third party it works with were compromised and this allowed the attacker to get unauthorized access and breach into Dunzo’s database. The company also revealed that no users’ home addresses were compromised during this data breach.
Dunzo is yet to reveal the number of user data that have been exposed in the breach but according to the haveibeenpwned website, 3,465,259 user accounts have been breached.
Dunzo is taking all the required steps so such incidents don’t happen again, the company said. In the blogpost, Dunzo noted, “We are ensuring your data’s security is our top priority and that every user is informed and aware. With the recent second wave of conversations around this breach, we are proactively re-sending communication to users as some may have missed the security update.”
Some of the safety measures Dunzo is taking are as follows:
* Secured all database and data stores from network and access standpoint
* Rotated all the access tokens and updated all passwords as a precautionary measure
* Tightened infrastructure security and closed all the vulnerable ports
* Reviewed and updated all access privileges to the system and infrastructure
* Enabled Firewall and Threat intelligence tool for even better monitoring
* Reviewed all the third-party plugins and integrations
* Enhanced logging and tracing even further across various services to monitor and get alerted about any suspicious activity.