Hackers Access Data Of 8.4 Mn Zoomcar Users

Troubled rental car marketplace Zoomcar has become the latest enterprise to become a victim of a cyber attack. The Nasdaq-listed company informed the SEC on June 9 that it suffered a cybersecurity incident that led to a hacker accessing personal information of close to 8.4 Mn users.

The leaked data contained information like the affected users’ names, phone numbers, car registration numbers, personal addresses and email addresses. Zoomcar said there was no evidence that sensitive user information like financial information, passwords, among others, was leaked. 

“The company became aware of the incident after certain employees received external communications from a threat actor alleging unauthorised access to company data. Upon discovery, the company promptly activated its incident response plan,” Zoomcar’s SEC filing read.

Zoomcar claims to have a user base of over 10 Mn users across 99 Indian cities. 

Besides informing regulatory and law enforcement authorities, Zoomcar said it has taken cybersecurity measures like incorporating safeguards across its cloud and internal network, increasing system monitoring, and reviewing access controls. 

Zoomcar didn’t say if it has informed the affected users about the cyber attack or the exact extent of the damage that it has caused. Inc42 has reached out to the company to get more details about the incident. The story will be updated on receiving a response. 

This comes at a time when digital frauds and cyber attacks are on the rise in the country. For instance, Inc42 reported yesterday that scamsters have set up a fake food delivery website Jio Eat, impersonating Reliance Retail and Jio, to defraud unsuspecting citizens.

As per the finance ministry, the country saw 2.4 Mn incidents of digital fraud amounting to INR 4,245 Cr in the first 10 months of FY25.

Zoomcar’s Financial Woes 

Founded in 2013 by David Back and Greg Moran, Zoomcar operates a one-stop shop platform for renting self-driving cars. It connects car owners with guests, who can choose from a selection of cars for use at affordable prices. The company listed on Nasdaq in December 2023 via a SPAC deal.

The cyber attack comes at a time when Zoomcar finds itself in murky grounds due to founder exits, legal turmoil and an acute financial distress. Speaking with Inc42 in January, the company’s then CEO Hiroshi Nishijima shared a three-pronged strategy to help the company keep its boat afloat – improving cashflows by expanding the offerings, repaying debt via further capital raise, and reducing expenses. 

However, in May, Nishijima stepped down from his position of CEO. He was replaced by ex-Uber business development head for APAC Deepankar Tiwari. 

On the financial front, Zoomcar managed to trim its loss by 45% to $7.9 Mn in the December quarter from $14.4 Mn in the year-ago quarter. The drop in loss came on the back of the company cutting its expenses substantially. 

Zoomcar’s total expenses stood at $5.7 Mn, down 60% from $14.1 Mn it spent in the year-ago quarter. However, its top line remained almost flat in the quarter, with the company registering a total revenue of $2.5 Mn as against $2.4 Mn in the year-ago quarter. 

Despite this, the company’s accrued losses continue to put a question mark over its future. At the end of 2024, Zoomcar had a negative working capital of $40.8 Mn. 

“The company’s cash position is critically deficient and critical payments to the operational and financial creditors of the company are not being made in the ordinary course of business, all of which raises substantial doubt about the company’s ability to continue as a going concern,” Zoomcar said in its February filing.

The company said it expected to incur more losses over the next 12 months and thus planned to raise additional funding.

“Management has evaluated the significance of the conditions described above in relation to the company’s ability to meet its obligations and concluded that, without additional funding, the company will not have sufficient funds to meet its obligations within one year from the date the condensed consolidated financial statements are issued,” it said.