Major Data Breach at Indian Pharmacy Chain Exposes Customer Orders and Critical System Controls
A critical security vulnerability in one of India's largest pharmacy chains granted unauthorized users complete administrative access to the platform, exposing sensitive customer order data and prescription management systems. The incident affected DavaIndia Pharmacy, the retail pharmacy division of Zota Healthcare, which operates an extensive network of pharmaceutical outlets throughout India.
Security researcher Eaton Zveare identified the vulnerability after discovering insecure super administrator application programming interfaces (APIs) on DavaIndia's web platform. The researcher promptly disclosed the findings to Indian cybersecurity authorities through proper channels. The vulnerability has since been remediated, and Zveare has published a detailed technical disclosure of his findings.
The security incident occurred during a period of aggressive expansion for Zota Healthcare's DavaIndia Pharmacy operations. The Gujarat-based organization currently maintains over 2,300 retail locations across India, with 276 new stores launched in January alone. The company has announced plans to deploy an additional 1,200 to 1,500 locations over the next 24 months.
Technical Analysis of the Vulnerability
According to Zveare's investigation, the security flaw originated from inadequately secured administrative interfaces that permitted unauthenticated users to provision super administrator accounts with elevated privileges. An attacker exploiting this vulnerability could:
• Access and view thousands of customer orders containing personally identifiable information (PII)
• Modify product catalog entries and pricing structures
• Generate unauthorized discount vouchers and promotional codes
• Alter prescription requirement flags for controlled substances
• Manipulate website content and configuration settings
System timestamp analysis indicated the vulnerable administrative endpoints had been exposed since late 2024. The compromised access encompassed approximately 17,000 online orders and administrative controls for 883 retail locations, enabling unauthorized modifications to pricing, prescription validation rules, and promotional mechanisms.
Data Privacy and Healthcare Security Implications
Pharmaceutical transaction data represents a particularly sensitive category of personal information, as it may reveal details about an individual's medical conditions, prescribed treatments, and other confidential healthcare-related purchases. The exposure of such data, regardless of whether exploitation occurred, presents significant privacy concerns and potential patient safety risks that exceed those associated with conventional e-commerce data breaches.
"Customer information was linked to their orders," Zveare explained. "This includes name, phone numbers, email IDs, mailing addresses, total amount paid, and the products purchased. Since this is a pharmacy, the products being purchased could be considered private and even embarrassing for some people."
Disclosure Timeline and Remediation
Zveare reported the vulnerability to CERT-In (Indian Computer Emergency Response Team), India's national cybersecurity incident response organization, in August 2025. The security flaw was patched within several weeks following the initial disclosure. However, formal confirmation from Zota Healthcare was not received by cybersecurity authorities until late November.
Sujit Paul, Chief Executive Officer of Zota Healthcare, did not respond to multiple email inquiries regarding the incident. The researcher emphasized that forensic analysis revealed no evidence suggesting the vulnerability had been actively exploited by malicious actors prior to remediation.
Sources:
Security researcher's disclosure - Eaton Works
Zota Health Care expansion announcement - Business Standard
DavaIndia expansion plans - MSN
