Upstox alerts users of data breach; says funds, securities remain safe

MUMBAI: After attacking Indian start-ups and unicorns, hackers have now started targeting stock broking firms. Upstox, India’s second largest broking firm in terms of number of active clients, on Sunday said its databases including contact details and KYC may have been breached. The discount brokerage firm said that it upgraded its security systems manifold recently, on the recommendations of a global cyber-security firm against a suspected data breach. It also has assured the clients that their funds and securities are protected and remain safe.

The steps were taken after it received emails claiming unauthorized access into its database. “These claims suggested that some contact data and KYC details may have been compromised from third-party data-warehouse systems,” the retail broking firm said in a statement on its website.

There has been a sudden spurt in a number of instances of data breach at technology and digital media companies in the financial services space and e-commerce. Companies such as Nykaa, BigBasket, Dunzo, Edureka, Freshmenu, Just-Dial, Mobikwik, Paytm Mall, WhiteHat Jr, Zomato too have reported data breaches recently.

Upstox further stated that client’s funds can only be moved to their linked bank accounts and all securities are held with relevant depositories. “As a matter of abundant caution, we have initiated a secure password reset via OTP,” said the retail broking firm, adding further that, it has also strongly fortified its systems to the highest standards.

Upstox did not specify the number of client accounts that could have been exposed though industry sources said that there are increasing instances of such breaches happening across the sectors.

Upstox said in its statement that it has immediately restricted access to the impacted database and added multiple security enhancements at all third-party data-warehouses, set up real-time 24x7 monitoring and additionally ring-fenced the network

International chains of hackers have in recent times, stepped up attacks on Indian start-ups and unicorns, drawn by the atmospheric valuations being quoted. According to network security experts, start-ups typically outsource non-core functions to a galaxy of service providers, including cloud services providers for both trading engines and data storage. Hackers tap into the vulnerabilities at the multiple inter-connect points between the core systems and the subsidiary service providers.