DisclosureLens
FEDERALItem 1.05 · mandatoryHackingTransportation & LogisticsTechnologyTransportationCar RentalExtortion DemandData ExfiltratedCustomer Data InvolvedPIIIdentity (basic)HighActive

Zoomcar Holdings, Inc.

bd_8e398ea4d67615f9 · schema v1 · pii pii-v1

Severity

High

Discovered

Jun 9, 2025

Filed

Jun 13, 2025

To disclose

4 days

Affected

8,400,000

Confidence

89%
Full breach record for Zoomcar Holdings, Inc. →

Zoomcar Holdings, Inc. disclosed on a Form 8-K Item 1.05 that on June 9, 2025 it identified a cybersecurity incident in which an unauthorized third party accessed a limited dataset containing personal information of approximately 8.4 million users, including names, phone numbers, car registration numbers, addresses, and email addresses. The company became aware after employees received external communications from a threat actor. No financial information or plaintext passwords were reportedly compromised. The company activated its incident response plan and notified regulators and law enforcement.

SEC clockMateriality determined Jun 9, 2025 → Filed Jun 13, 20254d ✓ SEC 4-day OK4 days discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 4 days

Jun 9, 2025

Discovered

Jun 13, 2025

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed8,400,000 affectedView incident

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filing

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statementThis record

Unlocks: materiality, stated response, full audit trail. Ceiling removed.