Your phone number, shared while shopping at a neighbourhood supermarket, could end up in a database sold to marketers or exploited by cybercriminals. From customer databases and third-party vendors to underground online marketplaces, personal information can change hands without the individual knowing where it ends up.

To advertise here,

Explaining how such data circulates, cybersecurity expert Nandakishore Harikumar, in an interview with Mathrubhumi English, said information stolen in data breaches can be traded through anonymous online channels before being sorted and sold to different buyers.

“Basically, the dark web is the initial point where breached data is shared. Earlier, a central figure would act as a data broker, but now cybercriminals can directly download the data from these groups,” he said.

According to Harikumar, cybercriminals may use platforms such as Telegram and the dark web to share or sell stolen information while concealing their identities. They may seek payment through cryptocurrency, making it difficult to identify those involved.

“So when we started business it was just 800 rupees for around 10 million users' data,” he said, describing the scale and low cost of data available in underground markets.

In September 2025, luxury goods group Kering confirmed that an unauthorised third party had accessed customer data from some of its brands, including Gucci, Balenciaga and Alexander McQueen. Kering said the intrusion was detected in June 2025 and that the data accessed was “limited”. ShinyHunters, which claimed responsibility, told the BBC it had gained access in April and claimed to hold data linked to 7.4 million unique email addresses.

How does your phone number reach the wrong hands?

The journey of personal information does not necessarily end with the person or business that originally collected it. Harikumar said stolen databases may be purchased by intermediaries, who organise the information into searchable formats before passing it on to other buyers.

“Once they get this data, an intermediary buys it and organises the information, including phone numbers, into an Excel sheet. Marketing agencies then purchase this data from them,” he said.

He pointed out that personal information could also originate from businesses that routinely collect customers’ phone numbers, including local supermarkets.

“For example, imagine a supermarket vendor in a local region. What is he doing with this data? Like a small supermarket where consumers regularly go and buy, you would have the realistic data of the people who live in that area; you can just pass it out,” he said.

Unsolicited calls during elections

Harikumar also cited unsolicited political calls as an example of how personal information can be used to reach people who may have no apparent connection to a particular constituency.

“So like a small supermarket where consumers regularly go and buy, you would have the realistic data of the people who live in that area; you can just pass it out,” he said, explaining how locally collected information could be valuable to those seeking to contact residents.

Recalling his experience during the last assembly elections in Kerala, he said he received automated calls from candidates in three different constituencies despite not being a voter in any of them.

“During the last elections, I got three calls. So one was from an MLA candidate in Thiruvananthapuram, one was from someone from Malappuram, and one was from Idukki. I got automated calls from all three. I’m not a voter in any of these constituencies,” he said.

He added, “I have no connection with any of those areas. Still, I’m getting calls, but I don’t have a provision to ask this. Okay, why are you calling me? I’m not a voter in that.”

Harikumar said such instances raised questions about the sources of the databases used for mass outreach and the extent to which individuals could determine how their information was being used. “If my MLA is calling me, I would say yes, it’s perfectly fine to call me. But we are using mass data for every activity,” he said.

He cautioned that personal information could reach marketers through multiple routes, including data breaches and information shared by vendors.