India’s rapid digital transformation is remarkable — millions of citizens transact online, businesses store huge volumes of data in the cloud, and government agencies digitize services at record speed. But with this explosive growth comes a dark side: data breaches.
In the last few years alone, India has seen some of the world’s largest and most alarming data leaks, affecting millions of citizens. Each breach has exposed the reality that even well-known brands, crucial public services, and startups often leave critical gaps in how they protect personal information.
These incidents highlight why the Digital Personal Data Protection Act (DPDPA) 2025 is so important — and why India’s businesses and institutions must rethink how they handle sensitive data.
As a cybersecurity expert, let’s break down some of the biggest breaches, what they reveal about India’s vulnerabilities, and how the public can better protect themselves in an era of data exposure.
India’s Recent Data Breaches: A Wake-Up Call
1️⃣ The Domino’s India Data Breach (2021)
In 2021, hackers claimed to have stolen over 180 million order details from Domino’s India — including names, phone numbers, email addresses, delivery addresses, and payment details. Worse, attackers created a search portal on the dark web where anyone could look up customers’ orders and personal information.
What went wrong:
Domino’s reportedly failed to secure its database with robust access controls and encryption. Attackers exploited this weak point to siphon off customer data undetected.
What it shows:
Popular brands are prime targets. Even everyday orders — pizza, groceries, cabs — can expose sensitive personal patterns when leaked.
2️⃣ COVID-19 Vaccination Data Leak
During the peak of India’s COVID-19 vaccination drive, reports emerged of Aadhaar numbers, phone numbers, and vaccination details being sold online. In some cases, threat actors exploited vulnerabilities in government-run apps and portals.
What went wrong:
Massive databases storing citizens’ health and identity data were often hosted on poorly secured servers or lacked adequate monitoring.
What it shows:
Critical public health infrastructure must be secured with the same seriousness as banking or defense systems — because the impact is personal and nationwide.
3️⃣ Mobikwik Data Leak (2021)
In one of India’s largest fintech leaks, up to 110 million users’ data — including KYC details, Aadhaar scans, phone numbers, and card info — was reportedly exposed and listed for sale on the dark web.
Mobikwik initially denied the breach but later launched an investigation under pressure from cybersecurity researchers and the public.
What went wrong:
Sensitive data like scanned IDs and financial info was allegedly stored without robust encryption or multi-layered security controls.
What it shows:
Fintech startups handling financial and ID data must comply with the strictest security standards — because the damage from leaks can be devastating.
4️⃣ Air India Passenger Data Leak (2021)
A breach at Air India’s third-party IT service provider compromised the data of 4.5 million passengers — including passport info, credit card details, and travel histories.
What went wrong:
A supply chain vulnerability: a third-party vendor’s systems were attacked, showing that even if your own security is strong, your partners’ weaknesses can expose your data.
What it shows:
Supply chain security is non-negotiable. Every vendor relationship must be vetted and monitored — because attackers always look for the weakest link.
What These Breaches Have in Common
Across these incidents, a few patterns emerge:
🔑 Weak access controls: Poor passwords, lack of multi-factor authentication, and over-permissive access.
🔒 Inadequate encryption: Sensitive data stored in plain text or with outdated encryption makes breaches worse.
⏰ Slow detection: Many breaches went unnoticed for weeks or months.
🤝 Vendor risk: Third-party partners often become the entry point.
🗣️ Poor transparency: Some organizations hesitated to admit breaches or delayed notifications — something the DPDPA 2025 now directly addresses.
The Cost for Ordinary People
When personal data leaks, the consequences aren’t theoretical:
-
Your phone number can become a magnet for spam and scam calls.
-
Stolen Aadhaar or KYC scans can be used for fraud.
-
Leaked payment info can lead to unauthorized transactions.
-
Your privacy — addresses, travel details, health status — can be exploited for social engineering scams.
How the Public Can Protect Themselves
While we can’t stop big companies from failing, we can take steps to limit the damage:
✅ Use strong, unique passwords for each app and service.
✅ Enable two-factor authentication (2FA) wherever possible.
✅ Be alert for phishing: If you get calls or emails claiming to know your private info, verify first.
✅ Monitor bank statements and credit reports for suspicious activity.
✅ Use trusted platforms — check an app’s security reputation before handing over documents or ID scans.
What Organizations Must Learn
The DPDPA 2025 is a direct response to these high-profile breaches — setting strict rules for consent, data minimization, encryption, and especially breach notification.
To comply and protect user trust, companies must:
-
Invest in robust encryption for stored and transmitted data.
-
Apply least privilege access: only those who need data should have it.
-
Vet and monitor vendors carefully.
-
Test systems regularly for vulnerabilities.
-
Have clear breach response playbooks ready — because speed matters.
Example: How Better Security Could Have Prevented Damage
Imagine the Domino’s breach with modern protections:
-
The database is encrypted at rest.
-
Strict access controls require multi-factor authentication for admins.
-
Anomaly detection tools alert the security team if massive data is accessed unusually.
-
If a breach still occurs, the company informs users promptly, helping them stay vigilant.
The Role of the Public Under DPDPA 2025
Thanks to DPDPA, the public now has more tools to hold organizations accountable:
-
You can request information about how your data is stored and shared.
-
You have the right to withdraw consent for data you no longer want companies to hold.
-
If your data is leaked, you must be notified quickly — so you can act.
Why These Breaches Shouldn’t Be Forgotten
It’s easy to treat each new breach as just another headline. But each incident is a real-world lesson that poor data security costs trust, reputation, and user safety.
As India’s digital economy grows — from UPI payments to online education — companies must understand that safeguarding personal data is not a nice-to-have. It’s now the law, the expectation, and the minimum standard for doing business.
Conclusion
India’s recent large-scale data breaches remind us that data protection is not theoretical — it affects our money, privacy, and daily lives. These breaches underline why the DPDPA 2025 is so crucial: to force businesses, public agencies, and startups alike to secure data with the seriousness it deserves. For individuals, they are a call to be vigilant: question where your data goes, take basic security steps, and demand accountability when companies fail.
As India embraces its digital future, we must all — companies, government, and citizens — treat personal data as precious. Because in the wrong hands, it truly is
