boAt Data Breach: Personal Information Of 7.5 Million Customers Leaked On Dark Web, No Response From Company

Customer data for over 7.5 million boAt customers has appeared on the dark web. Personally identifiable information (PII)-like name, address, contact number, email ID, customer ID and more-is available for purchase.

The threat actor has leaked around 2GB of data on the forum. On April 5, a hacker named ShopifyGUY claimed to breach the data of audio products and smartwatch maker boAt Lifestyle.

What is threat actor?

Threat actors, also referred to as cyberthreat actors or malicious entities, are individuals or groups who purposefully inflict harm on digital devices or systems. These actors exploit vulnerabilities in computer systems, networks, and software to carry out a range of cyberattacks, such as phishing, ransomware, and malware attacks, according to IBM.

Personal Information Of 7.5 Million Customers Leaked, Claims ShopifyGUY

The threat actor dumped files of data breach with access to PII information of customers, which has 75,50,000 entries. Forbes India verified the information by speaking to some of the customers who confirmed purchasing boAt products in the recent past.
These data breaches have an impact that goes beyond the immediate loss of personal information.

People are more vulnerable to financial fraud, phishing scams and identity theft. Sophisticated social engineering attacks could be framed by threat actors leveraging personal details of individuals to get access to bank accounts, conduct transactions, and use credit cards fraudulently, explains Threat Intelligence Researcher Saumay Srivastava, as reported by Forbes.

"The consequences for companies include a loss of customer confidence, legal consequences and reputational harm. The major implications make it even more essential to implement adequate security practices," he adds. An email sent to boAt Lifestyle did not elicit any response, as reported by Forbes.

No Response on the leak by boAt

The leaker's profile (ShopifyGUY) is relatively new and only has this leak under his belt. As the data is genuine, the hacker will gain a good reputation among the forum community, which will increase their future data sales, explains Rakesh Krishnan, senior threat analyst at NetEnrich. "Considering the timeline, we can assume that the hackers gained access to the boAt customer database at least one month ago and put the data on the forum yesterday."

Ideally, the company should notify all users, do a comprehensive investigation on how the attackers got in and what else they could access, and then obviously do a comprehensive revamp of their security measures to ensure they minimise the chance of this happening again, but realistically, it will deny and move on, unfortunately, explains Yash Kadakia, founder of Security Brigade, as reported by Forbes.

"The data is available for eight credits on some forums, so literally, it costs two euros to buy the data. It'll probably be available for free in a few days on Telegram. This data will be used by a lot of scammers for different phone and email scams."

Know About boAt

Founded in 2016 by Shark Tank judge Aman Gupta and Sameer Mehta, boAt has emerged as the second most popular wearable brand in the third quarter of 2023, as per an IDC report. The Gurugram-based company is widely popular among Indian consumers and is known for its reasonable earphones and other audio products. It also makes other products, like smartwatches and speakers.

A market leader in audio devices and wearables, boAt Lifestyle's sales crossed Rs3,000 crore in March 2023. Its total revenue stood at Rs3,403.1 crore against Rs2,886.4 crore in FY22. Reportedly, boAt witnessed a net loss of Rs129.4 crore in FY23 after posting a profit of Rs68.7 crore in FY22, as reported by Forbes.

The homegrown consumer electronics company filed its IPO papers in 2021, but deferred it due to market volatility. In October 2022, its parent company, Imagine Marketing, raised Rs500 crore from an existing shareholder, a Warburg Pincus affiliate, and a new investor, Malabar Investments.

Overall, the company has raised a total of $177 million to date from investors such as Qualcomm Ventures, InnoVen Capital, Navi Technologies and Fireside Ventures, among others. Notably, boAt competes against companies like Fire-Boltt, Noise, Xiaomi and Samsung.