Indian stock brokerage Angel One has confirmed a data breach stemming from an April 2023 incident, with the leaked data surfacing online and later being indexed by Have I Been Pwned. The exposure comprises roughly 7.9 million user records covering 6.8 million unique email addresses, along with names, physical addresses, phone numbers, bank account numbers, Permanent Account Numbers (PANs) and portfolio holdings.
While Angel One stressed that client securities, funds and credentials were not impacted, the exposed dataset is highly sensitive. The combination of email addresses, phone numbers, PANs and financial details provides ample material for targeted phishing, identity theft and account-takeover attempts against affected individuals.
What to take away: Even when login credentials aren’t directly compromised, breaches of this nature fuel downstream social engineering and credential-stuffing campaigns. Affected users should remain vigilant for tailored phishing and enable MFA wherever possible.