It seems BookMyShow recently suffered a data breach. A threat actor with an alias Tango486 is selling a huge database of users on a leak forum. As per the listing, the data belongs to BookMyShow. The database has personal records of 4.3 million BookMyShow users.
I accessed the sample data that includes username, email, date of birth, mobile number, gender, address, BookMyShow id, and transaction type.
There is no information on how this data was accessed. So, I cannot confirm if the company suffered a data breach or if the data was accessed by using any other method.
Back in 2019, several BookMyShow users reported unauthorized transactions in their accounts. At that time, the company put the blame on other platforms without revealing anything about the number of affected users. I am not sure if the recent data that is for sale belong to the previous breach or a new breach.
