Massive 273 Million Truecaller India Database Leaked Online – What’s Inside!

Cyber Press researchers uncovered a massive Truecaller database that was leaked five years after its breach. The database contained 273 million records of India Truecaller users’ data.

Truecaller, marketed as the “world’s best caller ID and spam blocking app,” experienced a data breach in February 2019, affecting 286 million users in India.

The Cyber Press team reported on the latest X (Twitter) and NSA database leaks yesterday. Following the recent incident, this massive database leak also increased the risk for Truecaller users in India.

We found a database in one of the well-known data leak forums containing multiple compromised files stored in the cloud, including 19 GB of files in .CSV format. These files contain the personal data of hundreds of millions of people, including the following:

• Phone Numbers
• Phone Carriers
• Full names
• Genders
• Locations
• Job Titles
• Company Names
• Email Addresses
• Websites
• Facebook IDs
• Twitter Usernames

Criminals may use this data goldmine to commit various malicious activities, including identity theft, phishing attacks, and unauthorized access to personal accounts.

Moreover, exposure to phone numbers and email addresses can increase spam calls and emails, compromising user privacy and security.

During the investigation, the Cyber Press team observed the leaked files contained data, including the following telecom network providers and their user’s personal data.

• 4M-Telewings.csv
• 9M-Aircel.csv
• 13M-Tata_Docomo.csv
• 19M-BSNL_Mobile.csv
• 50M-Idea.csv
• 50M-Vodafone.csv
• 53M-Reliance_Jio.csv
• 73M-Airtel.csv
• 249k-Sistema_Shyam.csv
• 404k-Telenor.csv
• 422k-Unitech_Wireless.csv
• 767k-MTNL.csv

The data breach significantly impacted several of India’s leading telecom companies, including:

• Reliance Jio – 53 Million Records
• Vodafone – 50 Million Records
• Airtel – 73 – Million Records
• BSNL – 19 Million Records
• Idea (Now merged with Vodafone) – 50 Million Records, among others.

Over 245 million phone numbers, email addresses, full names, locations, and other personal information were included in the data records released by dark web user “Frog” in the infamous data leak forum and validated by the Cyber Press team.

Though the data has been leaked from 5 years old data breach, the data leak involving phone numbers, email addresses, and locations poses considerable security risks, including:

1. Phishing Attacks: Attackers can send targeted phishing emails and messages to steal sensitive information or install malware.
2. Spam and Unsolicited Contacts: Victims may receive a flood of unwanted calls, messages, and emails.
3. Social Engineering: Attackers can impersonate trusted entities to manipulate victims.
4. Identity Theft: Personal data can be used to impersonate individuals for fraudulent activities.
5. Targeted Attacks: Location data enables more personalized and effective attacks.
6. Physical Security Risks: Leaked locations can lead to stalking or abduction.
7. Credential Stuffing: Email addresses can be used in attempts to access other accounts.
8. Scams and Fraud: Leaked contact information can be exploited for various scams.
9. Reputation Damage: For businesses, leaked customer data can result in lost trust and legal consequences.

Truecaller claims that the data in question does not originate from their database. They have conducted internal investigations and found no evidence of a breach.

To mitigate these risks, strong security measures, such as encryption, multi-factor authentication, regular security audits, and user education about recognizing and avoiding phishing and other social engineering attacks, are essential.

Follow us on LinkedIn for Exclusive Security Research and Updates.