Hackers threaten RentoMojo users via email; startup flags data breach

Be it grocery shopping and booking cabs or planning a new trip, digitisation has sped up activities, fueled by a plethora of user data. But as personal information of people across the globe is being uploaded online, securing it has become increasingly challenging.

After multiple arrests related to data leaks from Hyderabad, Bengaluru-based rental services platform RentoMojo has flagged a possible breach in its database.

Unauthorised access via sophisticated tactics

• The startup has warned users about cybercriminals gaining unauthorised access to user information, by exploiting cloud misconfiguration to carry out sophisticated attacks.

• The incident has been reported to authorities who are investigating the breach, and RentoMojo is coordinating with legal experts as well as cybersecurity professionals.

• The startup has also reassured consumers that UPI data as well as credit and debit card details are safe, since they aren't stored by them.

Hackers threatening users via email

• Users of the online rental service have also received emails from the hacker group ShinyHunters, claiming that they have KYC data including bank documents, passport, and driving license details.

• They threatened people to share the information publicly since RentoMojo isn't willing to pay up or respond.

• ShinyHunters are possibly the same group that had stolen user data from edtech platform Unacademy as well as e-grocer Big Basket.

• All passwords have been changed, and multi-factor authentication has been deployed to secure the database while third-party open-source plugins have been reviewed.