Bengaluru-based online rental marketplace startup RentoMojo has sent an email to its subscribers stating that the company has detected a security breach that involved unauthorised access to one of its databases.

The company, which has over 1 lakh subscribers, wrote in the email, “It appears that the attackers were able to get unauthorised access to our customer data, including in some cases personally identifiable information by exploiting the cloud misconfiguration through extremely sophisticated attacks, thus breaching one of our databases.”

RentoMojo has reported the cyber attack incident to the authorities and an investigation has been initiated. After detecting the attack, the company claimed to have updated all the passwords and reviewed all the third-party, open-source plugins and integrations.

While the email states that this will not impact any financial information of the subscribers, like credit and debit card details or UPI-related information, many RentoMojo subscribers received suspicious emails from ShinyHunters.

This is possibly the same group of hackers that became prominent in 2020. The group claimed to have stolen over one crore user accounts details from Unacademy and was allegedly responsible for BigBasket’s data breach which impacted over two crore users.

The email from the alleged attackers shared details of the accessed KYC document as evidence which, according to some subscribers, are accurate. The email states, “We have also downloaded terabytes of KYC including bank documents, passports, ID cards, driver’s license, etc. Nonetheless, it seems that RentoMojo is unwilling to pay a penny and would rather we share your data publicly given the lack of response on their end.”

Many RentoMojo users took to social media and shared screenshots of the email while asking for an explanation from RentoMojo.