Online travel booking website probes ‘security anomaly’
Cleartrip, owned by Walmart, reportedly suffered a data breach
Mihir Bagwe (MihirBagwe) •
July 19, 2022
A popular Indian online travel website owned by Walmart is investigating a cybersecurity incident amid indicators that it suffered a major data breach.
A spokesperson for Cleartrip said the company was investigating a “security anomaly” alongside an external forensics firm and had notified authorities.
Security Researcher Sunny Nehra tweeted a screenshot of an underground private forum showing spreadsheets apparently containing customer data and internal files.
Information Security Media Group could not verify Nehra’s statements. He did not respond to ISMG’s request for clarification on the source of the screenshot and the asking price for the data on the darknet forum. Nehra told TechCrunch the post was deleted hours after it was originally posted.
Indian e-commerce company Flipkart acquired Cleartrip in 2021 in a deal the Economic Times estimated based on a $40 million valuation. Walmart paid $16 billion in 2018 to take a majority stake in Flipkart.
“Legal actions and appropriate remedies are being evaluated and action is being taken as required by law,” Cleartrip told Information Security Media Group. India recently changed its breach reporting guidelines to impose a six-hour reporting rule for cyber incidents.
A Cleartrip customer tweeted that he had received a breach notification from the company assuring him that “no sensitive data regarding your Cleartrip account has been compromised” and that only “certain details forming part of your profile” had been disclosed.
— Wines (@vinayverma99) July 18, 2022
The Cleartrip incident follows other cybersecurity attacks against India’s travel and tourism industry. In May, ransomware attackers targeted passenger airline SpiceJet with a ransomware attack. The company said the attempted attack was “contained”, but its impact on IT infrastructure grounded several flights across India (see: Attempted ransomware attack for SpiceJet flights).