BSNL November 2023 Alleged Data Breach
This record concerns an alleged incident associated with Bharat Sanchar Nigam Limited (BSNL), India’s state-owned telecommunications operator, and a November 2023 claim by the threat actor Perell.
This classification is based on a reviewed lower bound; the actual impact and severity may be higher.
Exposed Data Types
6- Email addresses
- Names
- Phone numbers
- Physical addresses
- Billing information
- Purchase history
About This Record
The reviewed sealed archive’s information file gives 30 November 2023 as the breach date and names Perell, BSNL and the same data scope together. Its claim of 152,072 lines including the header for “working_lines_tcr.csv” exactly matches the archive member’s 152,071 data records plus one header line. That exact count binds this archive version to the allegation.
The Cyber Express reported on 22 December 2023 that Perell claimed access to approximately 2.9 million lines containing e-mail, billing and contact data, while noting that BSNL had not confirmed the incident. Its 25 April 2024 follow-up says Perell re-released the data on 24 April and that it was the same dataset dating back to 2023, not a new event. A catalogued 2014 bsnl.in event and the possible intrusion CERT-In reported on 20 May 2024 are distinct and were not merged into this record. Because no operator confirmation was located, this record is marked unverified.
The archive sidecar claims 232,244 unique e-mail addresses and 2,852,069 total lines, while the full technical review found 2,889,835 parsed data records. Only source headers explicitly named “email”, “email_id” or “bill_email_id” produced 1,341,886 valid e-mail occurrences and 230,561 unique canonical e-mail addresses. No count was fitted to the published claims: the exact number of affected people is unknown, so pwnCount remains unset. The 230,561 figure is only an evidence-backed lower bound of unique e-mail addresses in the reviewed archive, not a person count.
The source and public reporting also describe names, phone numbers, physical addresses, billing information and order or purchase information. Only the verified explicit e-mail fields are imported. Sample rows in the information file, headerless members and e-mail-like values in fields not authored as e-mail fields were expressly excluded; no other personal fields are imported. An e-mail match alone does not prove that a person was a BSNL customer, owns an account, or that any other field belongs to the same person.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
