-
A hacker claims to sell 4,624,461 records linked to ACC Limited, an Indian cement and building materials firm.
-
The listing reportedly includes contact details, birth dates, location data, verification fields, and password related material.
-
Nobody has verified the claim. The database structure also raises doubts about whether the records belong to the company.
Someone is offering a large database for sale on an underground hacker forum. The seller says the data comes from ACC Limited, a well known Indian company. ACC makes cement and other building materials. So far, nobody has proven the seller’s claim. Several details in the listing also look strange.
Hacker Offers Millions of ACC Limited Records
A threat actor posted the sale on a cybercrime forum. The post claims the database holds 4,624,461 records. The seller links the data to acclimited[.]com, the official website of ACC Limited. A threat monitoring account on X shared the details of the alleged sale.
According to the report, the database holds account and profile information. It lists contact details, dates of birth, and city and country fields. It also includes verification flags and other account attributes. The seller also mentions password-related material.
ACC Limited is a real company. It is an established Indian building materials business within the Adani Group. Its official website shares details about its operations, customer services, and corporate activities. Anyone can confirm that the company exists. That fact does not prove the hacker’s story, however.
Reports say no independent evidence supports the sale so far. Nobody has confirmed the exact number of records, nobody has confirmed that the data is real. Nobody has confirmed the link to ACC Limited either. For now, the listing counts only as an unverified claim from a threat actor. It does not count as a confirmed security incident. The difference matters, because a claim can turn out wrong.
Strange Database Fields Raise Doubts About the Source
The structure of the database stands out first. Reports say the fields look like data from consumer platforms or subscription apps. A cement maker’s main business usually does not collect that kind of information. This gap makes the claim harder to trust.
Such fields usually appear in apps where people create accounts and profiles. The reported list includes verification flags, city and country entries, and birth dates. A cement company’s main work involves making and selling building materials. These two things do not line up easily. That is why reports call the structure a notable concern.
The mismatch does not prove the seller is lying. A company can run many digital platforms. It can also collect customer details through online services. Some firms also use third-party providers. Any of these cases could explain the odd fields. Reports stress that the mismatch alone proves nothing.
Still, the mismatch leaves open questions about where the records first came from. The hacker may have named the wrong organisation. The data may also come from a third party. It could belong to an unrelated app. It might even come from an older leak. The available information cannot rule out any of these options.
The report also points to a gap in the evidence. Nobody has examined sample records on their own. No one has provided reliable proof of where the data originated. The affected company has not confirmed anything either. Because of this, readers should not treat 4.6 million as the number of real victims.
Possible Risks Depend on What the Data Holds
Real personal data would put people at risk. This applies only if the database is authentic. According to the report, criminals could use names and contact details to write believable phishing messages. They could also pretend to be trusted organisations. Some might try to take over online accounts. Previous data leaks in India have also been linked to a rise in fake ID extortion scams, showing how exposed personal information can create further risks for victims.
The password material adds another question. The risk depends on the form of those passwords. Some may be plain text. Some may be hashes. Others may be encrypted values or different login data. Each form carries a different level of danger. The report does not say which form the seller offers. It also does not say whether the data could open any accounts.
ACC Limited publishes a privacy policy that explains how it handles personal information. The policy also describes steps meant to protect that information. The company’s risk management report lists cybersecurity and data privacy as areas that need steady attention. These documents give useful background. They do not confirm the reported incident.
The sources reviewed for this report do not confirm ACC Limited as the source of the database. No verified evidence shows that anyone stole 4.6 million records from its systems. Readers who want to reach the company can use its contact page.
One question remains at the center of the story. Is the data real, and does it truly connect to ACC Limited? Credible technical proof or an official statement could answer that. Until one of them appears, the claim stays unconfirmed.
Fact-check verdict: Unverified. A threat monitoring account reported the alleged sale. The record count, the data’s authenticity, and the link to ACC Limited all remain unproven.
