Data Breaches

Zoomcar Says Hackers Accessed Data of 8.4 Million Users

The Indian car sharing marketplace Zoomcar learned that its systems were hacked after a threat actor contacted employees.

Eduard Kovacs

Published

June 16, 2025

The Indian car sharing marketplace Zoomcar learned that its systems were hacked after a threat actor contacted employees.

India-based car sharing marketplace Zoomcar learned recently that some of its systems were hacked, and an investigation showed that the information of millions of users was compromised as a result.

Zoomcar connects vehicle owners with people seeking car rentals. Its services are available in India, Indonesia, Egypt and Vietnam.

Zoomcar Holdings, Inc. has informed the US Securities and Exchange Commission (SEC) that it learned of unauthorized access to its IT systems on June 9.

“The Company became aware of the incident after certain employees received external communications from a threat actor alleging unauthorized access to Company data,” Zoomcar told the SEC.

The company’s investigation to date has determined that hackers accessed a “limited dataset” that included the personal information of 8.4 million users, which is described as a “subset of users”.

Compromised information includes name, phone number, car registration number, physical address, and email address. There is no indication that passwords, financial data, or other sensitive information was accessed by the threat actor.

Advertisement. Scroll to continue reading.

“To date, the incident has not resulted in any material disruption to the Company’s operations,” Zoomcar said. “However, the Company continues to evaluate the scope and potential impacts of the event, including legal, financial, and reputational considerations, as well as any associated remediation costs.”

It’s unclear who is behind the attack on Zoomcar. No known ransomware group has taken credit for the hack at the time of writing.

This is not the first significant data breach suffered by Zoomcar. The company’s systems were also hacked in 2018, when the attacker managed to steal more than 3.5 million user records, which they later attempted to sell.