Breaches and incidents
Tata Motors (India): AWS keys in E-Dukaan web code exposed customer invoices and 70 TB of fleet data
TechCrunch reports researcher Eaton Zveare found private AWS keys in the source of Tata Motors’ E-Dukaan spare-parts portal, exposing hundreds of thousands...
- Disclosed
- Verification
- Reported by a reputable outlet, citing the company
What happened
- TechCrunch reports researcher Eaton Zveare found private AWS keys in the source of Tata Motors’ E-Dukaan spare-parts portal, exposing hundreds of thousands of invoices with names, addresses and PAN numbers, database backups, over 70 TB of FleetEdge fleet-tracking data, a Tableau admin login with data on 8,000+ users, and Azuga API access. The flaws date from 2023.
- Root cause: cloud credentials embedded in client-side code.
- Attacker: none known; researcher disclosure.
- Response: reported via CERT-In in Aug 2023; Tata Motors told TechCrunch all flaws were fixed in 2023 and said they were “promptly and fully addressed”; it did not say whether customers were notified.