IndiaMART 2021 Data Exposure
The IndiaMART 2021 data exposure concerns a dataset of more than 38 million rows associated with IndiaMART and posted on a hacking forum in August 2021. A verified index reports 20,154,583 unique email addresses in the dataset.
Exposed Data Types
4- Email addresses
- Names
- Phone numbers
- Physical addresses
About This Breach
Total rows and unique emails are different measures: they are not added together, and the evidence does not establish that 38 million distinct people were affected.
Economic Times reported that the sample contained numerous IndiaMART references and that some tested email addresses matched registered accounts through the service's password-reset flow. IndiaMART said its preliminary investigation found no leak and that sellers' basic contact details were already advertised on the platform. The absence of passwords did not resolve the acquisition method. Public evidence does not establish whether the data came from a system breach, an insider, or large-scale web scraping, so the title uses the more cautious term data exposure.
What information was present?
Confirmed classes are email addresses, names, phone numbers, and physical addresses. Reporting also lists business-contact fields such as company name, role, country, city, postal code, and website in sample rows. The sources do not list passwords, password hashes, payment cards, bank accounts, or government identification. They also do not show that every field occurred in every row or that every listed address was a home address.
Privacy boundary and safe next steps
An email match does not establish how a person's information was collected, whether the person used IndiaMART as a buyer or seller, or whether a physical address remains current. Even so, aggregated contact data can support targeted phishing, false quotations, and payment-redirection attempts. Order, invoice, supplier, or account messages claiming to represent IndiaMART should be verified through a known official channel rather than a link in the message. Because password exposure is not confirmed for this event, this record alone should not be treated as proof that a password was leaked.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
