Zoomcar Holdings, Inc. suffered a significant cybersecurity breach compromising the sensitive personal information of approximately 8.4 million users. The incident, discovered on June 9, 2025, exposed names, phone numbers, vehicle registration details, personal addresses, and email addresses. The breach targeted a specific dataset containing personally identifiable information (PII) rather than the entire infrastructure. While financial information and plaintext passwords remained secure, the exposed data could be used for identity theft, social engineering, or phishing attacks. Zoomcar activated its incident response plan, implemented containment measures, and engaged third-party specialists to enhance security controls.

Zoomcar suffered a data breach incident and the personal data of its around 3.5 million users were put on sale on the dark web. The data included names, email ids, passwords, mobile numbers and IP addresses and the hacker offered to sell the data of 9 million users for $300.

Zoomcar, a Bengaluru-based car share company, reported a data breach discovered on June 9, 2023, affecting the personal information of 8.4 million users. The breach included names, phone numbers, car registration numbers, addresses, and emails. Although no financial information or passwords were stolen, the incident may lead to reputational and remediation costs. The company has implemented additional safeguards and hired a cybersecurity firm to help with the response. Zoomcar has faced a similar breach in July 2018, affecting 3.6 million customers.