A major data breach has exposed 500 GB of KYC data leaked

A major data breach has exposed the personal information of over millions of individuals associated with top Indian financial institutions, including public and private banks, insurance firms, and NBFCs. The breach was traced to a misconfigured, publicly accessible storage bucket tied to saarathi.ai.

The unsecured bucket contained approximately 500 GB of confidential Know Your Customer (KYC) documents and client data, posing serious risks to data privacy and regulatory compliance.

This exposure places affected entities at risk of significant consequences, including phishing attacks, identity theft, unauthorized transactions, and potential penalties under India’s DPDP Bill—up to ₹250 crore for non-compliance. The 2025 Verizon Data Breach Investigations Report highlights that 30% of breaches now involve third-party vendors, with API vulnerabilities and unauthorized access being leading causes.

This incident underscores the urgent need for stronger third-party risk management. With 98% of global organizations linked to at least one breached vendor, financial institutions must enforce tighter controls, vendor assessments, and compliance frameworks to safeguard customer data.

Organizations should immediately assess their exposure, contact the responsible vendor for clarification, request takedown of the exposed bucket, and notify compliance teams. Monitoring for suspicious activity and reinforcing cybersecurity measures across digital systems is critical to mitigating further damage.