Truecaller India Caller-ID Data Compilation (2019): ~47.5M Indian Records (Phone, Email, Carrier, Facebook ID) Sold - Truecaller Denies a System Breach

About Truecaller India

Truecaller is a caller-identification, spam-blocking, and contact app (developed by Sweden-based Truecaller AB) with especially large adoption in India. It aggregates phone numbers and names, largely from crowdsourced address books, to provide caller ID.

Why They Hold Your Data

Caller ID and spam-blocking platforms aggregate phone numbers, contact names, device identifiers, call metadata, and crowd-sourced identity labels to map real-world identities to phone numbers at scale.

Recent Developments

In 2019, a dataset of ~47.5 million Indian Truecaller users was offered for sale on the dark web (for about $1,000). Truecaller denied any breach of its systems, stating its databases were secure and that bad actors had likely compiled multiple phone-number databases and labeled the result "Truecaller." Researchers found no evidence of a Truecaller hack.

Data Points Exposed

Breach Impact

The circulating dataset ties phone numbers to names, emails, carriers, gender, and Facebook IDs for tens of millions of Indian users, enabling large-scale phishing/smishing, SIM-swap targeting, and identity enrichment. Because Truecaller disputes a system breach, the data is best understood as a compiled/aggregated dataset attributed to Truecaller rather than an exfiltration from Truecaller itself.

Exploitation & Downstream Threats

• Large-scale phishing and smishing using phone + name + email | • SIM-swap targeting using phone + carrier data | • Identity enrichment linking phone, email, and Facebook ID | • Targeted scams against Indian mobile users

What You Should Do

1. Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
2. Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.

How ObscureIQ Can Help

1. Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
2. Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
3. ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).