WHEN TRUST GOES PUBLIC: THE DUKAAN DATA LEAK THAT NOBODY SAW

Threat Summary

Category: E-Commerce Data Breach / Financial Credential Exposure
Features: Leaked API tokens, unprotected Kafka broker, exposed transaction streams, long-term merchant vulnerability
Delivery Method: Misconfigured Apache Kafka endpoint (publicly indexed), unsecured data streaming service, continuous transmission of live order data
Threat Actor: Unknown (potential exposure to APT & financially motivated cybercrime groups, including Lazarus cluster overlap)

---

A catastrophic configuration failure at Dukaan, one of India’s fastest-growing e-commerce platforms and a rival to Shopify, left a live data stream publicly accessible for nearly two years — exposing millions of merchants and customers to the risk of financial theft and identity compromise.

Researchers uncovered an open Apache Kafka broker belonging to Dukaan that continuously broadcasted over 270,000 messages per day, including merchant order data, customer details, and live payment credentials tied to major gateways like Stripe, PayPal, and RazorPay.

The leak, discovered in August 2025, had reportedly been active since August 2023, meaning sensitive merchant credentials and customer records may have been accessible for 24 months before the issue was closed.

With more than 3.5 million merchants and 16 million global users, the potential financial impact of the exposure is staggering — estimated in the hundreds of millions of dollars.

---

Core Narrative

The exposed Kafka instance allowed unauthenticated public access to a continuous stream of real-time e-commerce events. Unlike static database leaks, this was a live firehose of transactional intelligence — every order, refund, and payment authentication token transmitted in plaintext and visible to anyone who connected.

Data elements identified included:

• Customer names, emails, and phone numbers
• Physical addresses and geolocation metadata
• Order details, images, and product values
• Merchant identifiers and store IDs
• Active payment authentication tokens for Stripe, PayPal, and RazorPay

These tokens alone could have allowed attackers to directly interface with merchant payment processors, enabling fraudulent transactions, unauthorized refunds, and financial siphoning.

Researchers demonstrated that an attacker could issue “trigger orders” to prompt live data generation from the stream, capturing real-time transactions and tokens as they appeared. Over time, such an operation could drain merchant balances incrementally without detection — a hallmark tactic of advanced financial cybercrime.

The discovery underscores how unprotected middleware, such as Kafka brokers, can serve as silent breach vectors. Because the exposure didn’t rely on a perimeter intrusion or malware implant, it bypassed traditional detection systems entirely.

---

Infrastructure at Risk

• Merchants: More than 3.5 million affected, with potential full compromise of linked payment gateway accounts.
• Consumers: Over 16 million customers exposed to identity theft, targeted phishing, and data profiling.
• Payment Gateways: Ripple effect risk across Stripe, PayPal, and RazorPay ecosystems due to leaked authentication tokens.
• E-Commerce Integrators: Platforms using unmonitored Kafka brokers for data synchronization are now under scrutiny for similar exposures.

---

Policy / Allied Pressure

India’s Computer Emergency Response Team (CERT-In) was notified on September 9, 2025, and confirmed mitigation by October 8, 2025, but no official public statement has been issued.

The Information Technology (Amendment) Act of 2008 and Digital Personal Data Protection Act (DPDP), 2023 both mandate breach disclosure and protection of personal data. Failure to comply may expose Dukaan to substantial fines and regulatory investigations.

The incident arrives at a time when India’s e-commerce ecosystem is expanding rapidly, and confidence in homegrown platforms like Dukaan had been rising. This breach may damage that trust — especially given the prolonged exposure period and the sensitivity of the credentials leaked.

---

Vendor Defense / Reliance

Following disclosure, the exposed Kafka endpoint was secured, but as of publication, Dukaan has not issued a public statement.

Cybersecurity analysts note that Kafka brokers must be protected via:

• Strict network segmentation — limiting internal message streams to trusted IPs
• Authentication and TLS encryption — preventing public access and sniffing
• Real-time audit logging and anomaly detection — to catch long-term open streams
• Token isolation and rotation — revoking exposed credentials across all connected payment gateways

Payment partners are expected to initiate forced token invalidation to prevent abuse of exposed keys.

---

Forecast — 30 Days

Technical: Expect active scanning of public-facing Kafka instances by opportunistic attackers looking for similar misconfigurations.
Operational: Financial forensics may reveal silent incremental theft over the past two years — likely masked as legitimate merchant activity.
Regulatory: Indian CERT may impose data protection enforcement actions under DPDP 2023.
Reputational: Dukaan’s trust standing among global merchants will likely decline, prompting scrutiny across other Indian tech platforms.

---

TRJ VERDICT

This wasn’t a hack. It was a failure of architecture and oversight.

An open Kafka broker streaming authentication tokens and live payment data is the digital equivalent of broadcasting ATM keys over an unencrypted radio frequency. The two-year exposure period makes it one of the most negligent security lapses in recent memory.

The danger wasn’t hypothetical — it was operational. Attackers could have silently diverted funds, cloned customer data, and rerouted payments without ever breaching a firewall.

In an era when financial data moves faster than the audits meant to protect it, incidents like this prove that the weakest link in cybersecurity isn’t always the attacker — it’s the assumption that configuration equals security.

The digital economy runs on trust, and trust has a shelf life. Dukaan’s may have just expired.

---

Disclosure Timeline

• Leak Discovered: August 27, 2025
• Initial Disclosure: August 29, 2025
• CERT Contacted: September 9, 2025
• Leak Secured: October 8, 2025

---

---

---

---

---

---

---