A hacker claims to be selling millions of user records relating to Indian startup Shadowfax, which offers logistics services to e-commerce and hyperlocal platforms across the country.
The pseudonymous hacker said in a listing on a known cybercrime forum that they are selling the allegedly stolen Shadowfax data for an undisclosed amount. A portion of the data published in the listing claims to include mobile phone numbers, order delivery and pickup statuses, and tracking identifiers of users who received orders or processed pickups through the platform.
The hacker said the breach happened in November, which led to the compromise of five million users’ information.
It is unclear if the data was obtained directly from Shadowfax servers directly or as part of an existing breach incident.
TechCrunch verified some of the published data by passing the tracking identifiers through Shadowfax’s order tracker, which returned valid tracking information at the time we checked. TechCrunch shared the portion of the allegedly stolen data with Shadowfax co-founder and CTO Vaibhav Khandelwal, who told TechCrunch prior to publication that the company was “still validating the data if this is our data and tracking suspicious activity in our system,” and declined to comment further.
Shortly after TechCrunch contacted Shadowfax, the tracking identifiers that TechCrunch used to verify began returning an error message saying the identifiers were “not valid.”
Founded in 2015, Shadowfax is touted as India’s largest on-demand third-party logistics platform and works with some of the biggest e-commerce and hyperlocal food delivery companies in the country, including online grocery giant BigBasket; Zomato’s quick-commerce platform, Blinkit; and Flipkart’s fashion portal, Myntra. The company also works with brands such as Decathlon, Domino’s and Procter & Gamble.
Join 10k+ tech and VC leaders for growth and connections at Disrupt 2025
Netflix, Box, a16z, ElevenLabs, Wayve, Hugging Face, Elad Gil, Vinod Khosla — just some of the 250+ heavy hitters leading 200+ sessions designed to deliver the insights that fuel startup growth and sharpen your edge. Don’t miss the 20th anniversary of TechCrunch, and a chance to learn from the top voices in tech. Grab your ticket before doors open to save up to $444.
Join 10k+ tech and VC leaders for growth and connections at Disrupt 2025
Netflix, Box, a16z, ElevenLabs, Wayve, Hugging Face, Elad Gil, Vinod Khosla — just some of the 250+ heavy hitters leading 200+ sessions designed to deliver the insights that fuel startup growth and sharpen your edge. Don’t miss a chance to learn from the top voices in tech. Grab your ticket before doors open to save up to $444.
Shadowfax processes more than 1.5 million orders daily using a fleet size of over three million riders across over 2,500 cities in India, according to the company’s website.
The Bengaluru-based startup counts Flipkart, Eight Roads Ventures and TPG NewQuest among its investors.
Read more on TechCrunch:
