Indian pharmacy chain giant exposed customer data and internal systems

A security researcher discovered insecure “super admin” administrative APIs on DavaIndia Pharmacy’s website that allowed unauthenticated creation of high-privilege accounts, exposing nearly 17,000 online orders and administrative controls across 883 stores; the issue, present since late 2024, was reported to CERT-In in August 2025 and patched within weeks with no evidence of prior exploitation.