Over 3,300 User Records Leaked from Marathon.in Database

Data Breach Summary

On March 24, 2025, cybersecurity monitors discovered a significant data breach impacting Marathon.in, a prominent Indian real estate and property management platform. The leak was shared on darkforums.st by a user operating under the alias “wht”, and includes over 3,300 individual records in CSV format. The compromised data contains detailed personal, transactional, and contact information, suggesting a full compromise of internal systems or CRM databases.

---

📍 Where and How?

The leak was posted on a known underground forum used by cybercriminals to traffic in breached data. The CSV files appear to originate from multiple Marathon.in internal systems, including:

• Customer payment records with names, addresses, phone numbers, and payment details (amounts, bank names, cheque numbers).
• Internal user data, such as admin and staff credentials (names, email addresses, phone numbers, hashed passwords, login tokens, and last login dates).

The data includes both corporate and residential clients, with entries indicating bank transactions and real estate milestones (e.g., slab completion, possession, registration). Additionally, administrative user data points to a breach that may have extended into backend systems, potentially giving attackers broader access.

Breach History

As of this writing, there have been no previous publicly reported breaches involving Marathon.in. However, this leak may indicate broader, previously undetected vulnerabilities in the platform’s infrastructure. With both sensitive client and staff information exposed, the company must act urgently to identify and patch the source of the breach.

Further Action

Individuals whose data may be involved in the breach should take the following precautions:

• Change passwords immediately, especially if reused on other platforms.
• Monitor bank accounts and emails for unauthorized or suspicious activity.
• Be wary of phishing attempts, especially those referencing personal or real estate information.
• Contact the company to confirm whether your data was affected and inquire about support options.

What is InsecureWeb?

InsecureWeb is a Dark Web monitoring service that keeps track of recent data breaches and tracks their impact by monitoring the darkest places of the internet.

Our commitment lies in providing top-notch cybersecurity services to our clients. Through continuous monitoring of the dark web and advanced threat detection methodologies, we strive to identify potential breaches promptly, enabling swift response and mitigation efforts. With our state-of-the-art tools and expertise, we prioritize the confidentiality, integrity, and availability of our clients’ data.