If you have an Angel One account, assume your name, email, phone number, address, PAN and bank account details may be in circulation. Check your email on Have I Been Pwned, switch on two-factor login, never act on calls or WhatsApp messages claiming to be Angel One, and pull your credit report to spot loans opened with your PAN.
What Happened in the Angel One Data Breach
Angel One, one of India's largest retail stock brokers, disclosed an incident to the stock exchanges in April 2023. In July 2024, a dataset said to contain about 7.9 million Angel One customer records was posted on a hacking forum. Angel One said at the time that "no new data leak has happened," that the records related to the April 2023 incident, and that client securities, funds and login credentials were not affected.
On October 7, 2026, the breach-notification service Have I Been Pwned (HIBP) loaded the dataset after verifying it. HIBP counts 6,765,054 unique email addresses in the 7.9 million records, which means millions of people can now confirm whether they were included.
Not the Only Angel One Incident
This is separate from the February 2025 incident, when Angel One said a dark-web monitoring partner alerted it that some of its Amazon Web Services (AWS) resources had been compromised, exposing certain client data. If you were a customer in both periods, your details may appear in more than one dataset.
What Data Was Exposed
According to HIBP's verified listing, the records include:
- Names and email addresses
- Phone numbers and physical addresses
- Dates of birth
- Permanent Account Numbers (PANs) — India's tax ID
- Bank account numbers
- Portfolio holdings and other investment information
Passwords and trading PINs are not listed. That limits the risk of a direct account takeover, but the combination above is ideal raw material for targeted investment scams and loan fraud: a caller who knows your name, PAN, bank and which stocks you hold sounds very convincing.
Is your data already out there?
Leaked data ends up on broker sites and in scammers' hands. Run a free 60-second scan to see your exposure — then let us remove it.
Run a free scan★★★★★ 4.8/5 · Trusted by thousands of families
What to Do Right Now
1. Check whether your email is in the dataset
Enter every email address you have used with Angel One at haveibeenpwned.com. If it appears under "Angel One," treat every item in the list above as exposed. While you are there, check whether the same address appears in other breaches — our guide on checking if your password has been leaked explains what each result means.
2. Lock down your Angel One login
- Change your password and MPIN, and use a password you do not use anywhere else.
- Turn on two-factor authentication with an authenticator app (TOTP) rather than SMS where available.
- Review your registered email, mobile number and linked bank accounts for changes you did not make.
- Check your recent orders, fund transfers and any change requests in the app.
3. Watch for loans and cards opened with your PAN
A PAN plus date of birth and address is enough for some lenders and instant-loan apps to start an application. Download your credit report from CIBIL, Experian, Equifax or CRIF High Mark (each offers one free full report a year) and look for loan enquiries or accounts you do not recognize. Repeat every few months for the next year.
4. Treat every "Angel One" call, SMS and WhatsApp message as suspect
- Angel One will not ask for your OTP, MPIN or password over the phone.
- Ignore invitations to "VIP" stock-tip groups and "institutional" trading apps — these are the most common follow-on scam after a broker leak. See our guide on avoiding investment scams.
- Do not click links in texts about KYC updates or account suspension; open the official app instead. Our smishing guide shows the red flags.
- Ask your mobile carrier about SIM-swap protection, since your number is in the leak (see how SIM-swap attacks work).
5. Report fraud fast
If money leaves your account or you are scammed, call India's National Cyber Crime Helpline 1930 immediately and file a report at cybercrime.gov.in; speed matters for freezing transfers. Complaints about how a broker handled your account can be raised with Angel One first and then escalated through SEBI's SCORES portal.
Living in the US? Your Exposure Goes Beyond Angel One
Many Angel One customers are NRIs living in the US. Scammers who start with leaked broker data often enrich it from US people-search sites that publish your current address, phone, relatives and age. Removing those listings makes it much harder to build a convincing scam around you — compare your options in our list of the best data removal services.
How PrivacyOn Helps
You cannot pull leaked records back off a hacking forum, but you can shrink everything else attackers use to target you. PrivacyOn removes your personal information from 100+ US data brokers and people-search sites, re-checks them continuously because brokers relist, and includes 24/7 dark web monitoring that alerts you when your email or phone number shows up in a new leak. Plans start at $8.33/month and family plans cover up to 5 people. Run a free PrivacyOn scan to see where you are exposed today.
Frequently Asked Questions
Was Angel One hacked?
Angel One reported a data incident to the stock exchanges in April 2023, and a dataset of about 7.9 million customer records linked to it surfaced online in July 2024. Have I Been Pwned verified and added it in October 2026. Separately, Angel One disclosed a February 2025 compromise of some of its AWS resources.
How many people were affected by the Angel One data breach?
The leaked dataset contains about 7.9 million records with 6,765,054 unique email addresses, according to Have I Been Pwned.
Is my money or shareholding at risk?
Angel One says client securities, funds and login credentials were not affected, and passwords are not part of the dataset. The bigger risk is fraud using your details: scam calls, fake trading apps and loans taken out with your PAN. Secure your login with two-factor authentication and monitor your credit report.
Should I close my Angel One account?
Closing the account does not remove data that has already leaked. For most people the better move is to keep the account secured with a strong unique password, two-factor authentication and alerts, and to watch closely for fraud attempts that use the leaked details.
Can someone take a loan using my leaked PAN?
It is possible, which is why you should check your report at CIBIL, Experian, Equifax or CRIF High Mark for unfamiliar enquiries or accounts. If you find one, dispute it with the bureau and lender and report it at cybercrime.gov.in or by calling 1930.
How can I stop scammers from finding more information about me?
Remove yourself from the data brokers that publish your address, phone number and relatives. PrivacyOn does this across 100+ US broker sites, keeps monitoring for relistings and adds 24/7 dark web alerts, starting at $8.33/month.