← Hathway

2023–2024 Breach — 4.67M users, KYC

2024 4.7M records affected Share on X

Data compromised

Aadhaar, passports, KYC, names, addresses, phones, emails, password hashes

Technical writeup

Dec 2023. Indian ISP Hathway breached via PHP Laravel vulnerability. ~4.67M verified accounts. Exposed: Aadhaar, passports, KYC docs, names, addresses, phones, emails, password hashes, IPs. Threat actor created Tor search site. Data publicly released Jan 2, 2024.

Root cause

Laravel application vulnerability.

References