FOLLOW US

BuyUCoin, a cryptocurrency exchange based in India, suffered a massive data breach affecting thousands of users. The startup's platform allows users to buy, sell, trade, and store Bitcoin and other cryptocurrencies.

A hacking group, ShinyHunters was responsible for the data breach that compromised the personal information of more than 325,000 users.

Rajshekhar Rajaharia, a cybersecurity researcher, tweeted about the BuyUCoin data breach. He also posted screenshots of the leaked data which included the names, e-mail addresses, bank information, and know-your-customer (KYC) information that includes passport numbers and PAN of BuyUCoin users. The hacking group dumped the data on the dark web.

Trading in #cryptocurrency? 3.5 Lakh Users data including me leaked From @buyucoin. The leaked data contains Name, Email, Mobile, bank account numbers, PAN Number, Wallets Details etc. Again didn't informed to affected users by company.
Story - https://t.co/rUrfSQ96Z1#InfoSec pic.twitter.com/1xFOtLcd8F

— Rajshekhar Rajaharia (@rajaharia) January 21, 2021

However, BuyuCoin initially denied that its platform has been hacked and argued that the data dump available on the dark web included fake account details. The Indian cryptocurrency platform claimed that the report was just a "rumor" and claimed that “not even a single customer was affected.”

Rajahria pointed out that the data breach occurred last September, The hacking group not only stole users' information but also had access to admin credentials. He slammed BuyUCoin's initial response as "irresponsible" and demanded the company to inform its users about the data breach.

https://t.co/TNK1uXQKDL
Such an irresponsible statements by @buyucoin. I am your registered and #KYC Verified user. You leaked my own data too. Please change your statement ASAP. What if someone used my account in any illegal activity. Please Inform your users Right Now. #InfoSec pic.twitter.com/dJGN5VesEH

— Rajshekhar Rajaharia (@rajaharia) January 21, 2021

BuyUCoin eventually released an official statement indicating that it is conducting a thorough investigation into the data breach rumors.

The Indian cryptocurrency exchange wrote, "We are thoroughly investigating each and every aspect of the report about malicious and unlawful cybercrime by foreign entities in mid-2020." 

"Every BuyUcoin user with active portfolios has 3FA enabled trading accounts. All our user's portfolio assets are safe and sound within a secure environment. 95% of user's funds are kept in cold storage, inaccessible to any server breach," the company added.

Have a story you want USA Herald to cover? Submit a tip here and if we think it’s newsworthy, we’ll follow up on it.

Want to contribute a story? We also accept article submissions — check out our writer’s guidelines here.