The ICAI data breach: what every CA firm should do now under DPDP
A database of 600,000+ ICAI member records is circulating on breach forums. Here is what it means for chartered accountants — and the practical DPDP steps to take this week.
What happened
A threat actor operating under the alias "zowico" began advertising a dataset said to contain more than 600,000 records relating to members of the Institute of Chartered Accountants of India. Sample data shared by the actor points to exposure of membership numbers, Certificate of Practice details, email addresses, mobile numbers, dates of birth, membership dates, and physical addresses. Separately, the same actor has published what appear to be sample Chartered Accountancy examination answer sheets from the May 2026 cycle, suggesting a second compromise of an examiner-facing system.
At the time of writing, the authenticity and full scope of the dataset are still being assessed, and ICAI has not issued a detailed public confirmation. But the practical reality for members does not depend on the final forensic count: if your professional contact details are in the public domain through a leak of this kind, you are now a higher-value target for fraud.
Why this matters more for CAs than for most professions
Chartered accountants sit on a uniquely concentrated pool of sensitive data. A single mid-sized practice may hold PAN and Aadhaar details, bank statements, salary records, board resolutions, and financial statements for dozens or hundreds of client organisations. That makes the profession a high-value target — and it makes a CA firm a Data Fiduciary under the DPDP Act in its own right, with the same obligations to secure personal data, honour data principal rights, and notify breaches as any other organisation.
The ICAI leak is a reminder that the threat is not hypothetical. When an attacker holds a verified list of practising CAs with mobile numbers and membership numbers, the next step is almost always a convincing impersonation: a fake email from "ICAI" about your COP renewal, a WhatsApp message referencing your real membership number, or a spoofed client request to change bank details. These attacks succeed because they use real, leaked identifiers to manufacture trust.
What to do this week — for you personally
Three immediate steps. First, treat any inbound communication that references your membership number, COP, or exam details with suspicion — verify out-of-band before acting, especially on payment or KYC instructions. Second, enable multi-factor authentication on your email, ICAI portal login, and any cloud accounting platforms; a leaked password reuse is the most common path from "data exposed" to "account compromised". Third, warn your staff and articled assistants — phishing campaigns that follow a breach of this kind typically target the whole firm, not just the partner whose details leaked.
What to do this quarter — for your firm under DPDP
The breach is also the natural moment to address your own firm's DPDP posture. Under the Act, your firm is responsible for the personal data you hold about clients, employees, and their data principals. The May 2027 enforcement deadline is now close enough to plan against concretely, and the penalties for inadequate security safeguards run up to ₹250 crore for Data Fiduciaries.
A sensible sequence for a CA practice is to start with a data inventory — what personal data you hold, where it sits, who can access it, and how long you keep it. From there, a gap analysis against the DPDP requirements tells you where your firm is exposed. If you advise clients, you can also turn this into a service line: clients in the listed-company and regulated space are already being asked by their own boards to demonstrate vendor and processor compliance, and their auditor is a trusted first port of call for that conversation.
Our guide for chartered accountants walks through both sides of this — protecting your own practice and building DPDP advisory into your offering. See DPDP for CA firms for the practical framework.
The bigger picture: breaches are now a compliance event, not just an IT incident
Before the DPDP Act, a leak like the ICAI breach was primarily a reputational and security problem. Under the Act, a breach involving personal data triggers a statutory obligation to notify the Data Protection Board without delay, and to inform affected data principals. Organisations that cannot demonstrate reasonable security safeguards in the first place face the heaviest penalties. For CA firms — who both hold sensitive data and advise clients on governance — this reframes data protection from a back-office IT cost into a core professional and commercial issue.
The firms that respond to the ICAI breach not just by changing their own passwords, but by getting their DPDP house in order, will be the ones their clients turn to when the same questions land on the client's board agenda.
Frequently asked questions
Is my data definitely exposed in the ICAI breach?
The dataset's full authenticity and scope are still being verified, and ICAI has not published a detailed member-by-member confirmation. However, the prudent assumption for any practising CA is that your professional contact details may be in circulation. Act defensively regardless: enable multi-factor authentication, treat membership-number-referencing messages as suspicious, and verify payment or KYC instructions out-of-band.
Does the DPDP Act apply to my CA firm?
Yes. If your firm collects and processes personal data of clients, their employees, or other individuals — which virtually every practice does — it is a Data Fiduciary under the Digital Personal Data Protection Act 2023. That brings obligations to secure personal data with reasonable safeguards, honour data principal rights such as access and correction, and notify the Data Protection Board and affected individuals in the event of a breach. Enforcement is expected to be fully in force by mid-May 2027.
Can my firm offer DPDP advisory to clients?
Many CA, audit, and risk-advisory firms are adding DPDP readiness as a service line, because they already hold a trusted advisory relationship and understand their clients' data flows. The usual entry points are a data inventory and a gap analysis. Niti Bharat partners with CA firms on a white-labelled basis — you keep the client relationship and earn a referral share. Our DPDP-for-CA-firms guide explains how to structure it.
Build DPDP into your CA practice
Niti Bharat helps chartered accountants protect their own firms and add DPDP readiness as a client service line — white-labelled, with a referral share. Start with our free guide and readiness assessment.
DPDP for CA Firms (Free Guide)