India DPDP Enforcement Tracker

Cyber-security incident disclosed by the bank to BSE and NSE on 27 July 2026 under Regulation 30 of SEBI LODR, reference BCC:ISD:118:16:376. The filing states the bank received a communication from an anonymous source claiming access to certain data, that preliminary findings identify it as a potential business email compromise, that it is not expected to have any material impact, and that core business functions continued to operate normally. A claimed volume of roughly 1 TB including KYC files, Aadhaar and PAN details circulated in threat-intelligence write-ups. That volume is the attacker's claim and does not appear in the bank's filing, so it is not carried here.

Customer database reported exposed via an unsecured MongoDB instance, with names, email addresses, delivery addresses, phone numbers and hashed passwords offered on a dark-web listing. The company said it was evaluating the extent of the incident and had filed a complaint with the police. Press reports cited an account count, which is not carried here: no such count appears in a company or regulator publication.

Payment processing infrastructure breach involving masked card data and merchant transaction metadata, acknowledged by the company in its own account of the incident. Press reports at the time cited a far higher user count, which the company disputed. No affected-record count published by the company, a regulator, a court or a stock-exchange filing is carried here.

Order records including customer names, phone numbers, email addresses and delivery addresses were indexed on a searchable dark web portal. The company acknowledged an information security incident and denied that financial information was accessed. The Delhi High Court is reported to have directed removal of the offending URLs. Press reports cited order and card counts, which are not carried here: no such count appears in a company filing or a court document.

Data breach via SITA passenger system compromised 4.5 million Air India frequent flyer records including passport numbers, credit card data, date of birth, and ticket information.

KYC data reportedly compromised through a third-party data warehouse, including contact details, bank account information and identity documents. The 2.5 million figure matches what the company said publicly at the time.

Ransomware attack on hospital servers. Services were disrupted for over two weeks and CERT-In and NCIIPC were involved in the response. Press estimates circulated a patient-record count, which is not carried here: no figure appears in any AIIMS, CERT-In or government publication, and a Parliament reply on the incident gave none.

Attackers harvested payment card data and personal details of approximately 500,000 customers via a skimming script injected into the booking website. ICO investigation found inadequate security testing and authentication.

Extensive secret surveillance of employees' personal lives at service centre in Nuremberg. Records included health conditions, family circumstances, religious beliefs, and private life details. Records were accessible to 50+ managers.

Scraped personal data of 533 million Facebook users made available on a hacking forum. Data included phone numbers, full names, dates of birth, email addresses, and biographical information. DPC found inadequate technical and organisational measures.

Processing of personal data for targeted advertising without sufficient legal basis or transparency. Decision held that Amazon tracked browsing and purchase behaviour for advertising without meeting the specificity and informed-consent requirements.

Data of 15 million UK individuals processed by Equifax Inc. without adequate oversight of its US-based data processor. ICO found failures in security controls and data governance of cross-border transfers.

Scraped biometric data of billions of individuals from public sources to build facial recognition database, without consent and without lawful basis. Multiple national DPAs imposed parallel penalties.

Starwood guest reservation database breach affecting up to 339 million guest records including passport numbers, payment card data, and contact details. Breach began pre-merger with Marriott and was undetected for four years.