Breaches and incidents
DavaIndia Pharmacy / Zota Healthcare (India): unauthenticated “super admin” APIs exposed orders and control of 883 stores
TechCrunch reports researcher Eaton Zveare found insecure admin APIs that let anyone create super-admin accounts on the pharmacy chain’s platform, exposing...
- Disclosed
- Verification
- Reported by a reputable outlet, citing the company
What happened
- TechCrunch reports researcher Eaton Zveare found insecure admin APIs that let anyone create super-admin accounts on the pharmacy chain’s platform, exposing nearly 17,000 online orders (names, phones, emails, addresses, purchases) and admin control over 883 stores, including prices and prescription requirements. Interfaces had been live since late 2024. The company did not respond to TechCrunch; facts are per the researcher and TechCrunch.
- Root cause: administrative API endpoints with no authentication.
- Attacker: none; researcher disclosure, no sign of prior exploitation per the researcher.
- Response: reported to CERT-In in Aug 2025, fixed within weeks; company confirmation to CERT-In only in late Nov 2025.