- A threat actor claims to be selling an 18 GB dataset allegedly linked to Emergency Paisa, an Indian loan app.
- The listing reportedly contains over 3.2 million records, including phone numbers, PAN details, and email addresses.
- No confirmed breach has been established, and the claim has not been independently verified.
A threat actor on an underground forum is allegedly selling a large dataset linked to Emergency Paisa, a digital lending app in India that offers short-term personal loans. The listing was first flagged by cybersecurity monitoring account Dark Web Intelligence. It advertises an 18 GB CSV dataset with more than 3.2 million personal records.
According to the post, the dataset includes roughly 3,269,000 phone numbers. It also reportedly contains over 2.7 million Permanent Account Number (PAN) records and about 2,052,000 email addresses. The advertised data also includes full names, dates of birth, gender, and fathers’ names.
No price appears in the captured portion of the listing. It is also unclear when the records were collected. There is no way to tell whether they belong to current or former customers. It is also unknown whether the dataset contains duplicate entries or unique individuals.
These are claims made by the alleged seller. The available information does not confirm that the dataset is real or that the records came from an unauthorized access into Emergency Paisa’s systems.
No Independent Proof has Emerged Yet
A report published by Undercode News on October 9, 2026, also covered the alleged exposure. The report warned that the available intelligence was not enough to confirm a cybersecurity incident.
Emergency Paisa’s privacy policy states that the platform collects personal identification details during sign-up and loan applications. This includes names, dates of birth, gender, mobile numbers, email addresses, and PAN details. This confirms that the categories of data in the underground listing match what the app collects. However, it does not prove that the advertised dataset actually came from the company.
The platform identifies Suburban Finance and Investment Private Limited as the company behind its lending services. The available sources do not confirm whether the company has acknowledged the alleged exposure. There is also no report of customers receiving breach notifications or investigators examining the dataset.
No independent confirmation from major news outlets was found. No public statement from Emergency Paisa verifying the incident has been identified either.
Alleged sales of exposed financial data have also surfaced in other cases, including the claimed sale of 2.3 million Brazilian bank records on the dark web. For now, this remains an unverified data exposure claim, not a confirmed breach.
Fraud Risks Customers Should Watch for
If the records are genuine, the mix of personal details could create real privacy and fraud risks. Criminals could use names, phone numbers, dates of birth, and PAN details to craft more convincing phishing messages. They could also impersonate financial service workers or attempt identity-related fraud.
Fraudsters might use such information to pose as loan officers or debt-recovery agents. They could use personal details to make fake payment demands or trick people into sharing sensitive information. However, there is no verified evidence that any of this has happened in connection with this specific claim.
India’s Computer Emergency Response Team (CERT-In) advises organizations to protect sensitive data through proper access controls, encryption, security monitoring, and response plans. Its guidance also urges people to avoid suspicious links. It also warns never to share one-time passwords (OTPs) with callers claiming to represent banks or support teams.
Steps Customers Can Take Right Now
Customers concerned about this report should watch out for unexpected loan offers or repayment demands. They should be suspicious of any requests for verification codes. Always confirm communications through Emergency Paisa’s official channels before responding. Any suspected fraud should be reported to the appropriate CERT-In authorities.
The app is available on Google Play and continues to operate as normal. There is no public record of the company taking any action in response to the alleged listing.
The central question still has no answer. Does the alleged seller actually have genuine Emergency Paisa customer records? If yes, how were those records obtained? Until more evidence surfaces, this story remains an allegation.
