In January 2024, a hacker claimed to have breached Hathway, one of India's larger broadband and cable internet providers, and put KYC (identity verification) data for roughly four million customers up for sale on an underground forum. A few years earlier, in 2020, security researchers reported finding around 40,000 vendor and company records from IndiaMART's B2B marketplace circulating on cybercrime forums. Neither of these is breaking news. We're not writing about them because something just happened to either company this week — we're writing about them because both cases are well documented, and because what actually goes wrong in incidents like these is almost never exotic. It's rarely a nation-state operation or a zero-day nobody could have anticipated. More often it's an exposed database, a missed patch, or a setting nobody ever checked. Those are the same categories of mistake a small business website can make. The only real difference is scale.
"We're Too Small to Be a Target" Is the Wrong Instinct
Most attacks on small websites aren't a person deciding to target your business specifically. They're automated tools scanning large ranges of the internet for a handful of common, well-known gaps — an outdated plugin, a missing security header, a login page with no rate limiting — and flagging whatever answers. A site doesn't need to hold four million records to be in scope for that kind of scan. It only needs to be reachable, which every website, by definition, already is.
That's also what makes a breach the size of Hathway's worth paying attention to, even if your business will never hold anything close to that much data: the mechanics behind a breach of four million records and a breach of a few hundred are often the same shape. What changes is the size of the number at the end, not the nature of the mistake.
What Was Reported — and Why It's Worth Learning From
Hathway, January 2024. A hacker claimed on an underground forum to have obtained KYC data belonging to roughly four million Hathway customers and offered it for sale. Hathway has not, to our knowledge, published a detailed technical confirmation of the incident, and the claim came from the attacker rather than the company — but it was reported consistently across multiple independent security outlets at the time.
IndiaMART, 2020. Security researchers reported finding roughly 40,000 vendor and company records from IndiaMART's platform for sale on cybercrime forums, apparently obtained through an exposed access point rather than a sophisticated intrusion.
We're citing both as well-documented, illustrative examples of how incidents like this tend to unfold — not as anything that happened recently. The original reporting is linked at the end of this article.
The Pattern Behind Most Breaches, Small or Large
Across cases like these, and most other post-mortems we've read, the same short list of root causes keeps showing up:
- Exposed or misconfigured databases and APIs — left reachable without proper authentication, often not because anyone meant to leave them open, but because nobody checked.
- Unpatched software running behind the site, quietly carrying a known, already-public vulnerability.
- Weak or reused credentials on an admin panel, with no multi-factor authentication to catch a password that leaks somewhere else entirely.
- Missing email authentication — no SPF, DKIM or DMARC records — which lets someone send phishing email that appears to come from your own domain, to your own customers or vendors.
- Missing basic security headers, which make otherwise-preventable attacks like clickjacking or content injection easier than they need to be.
None of these require a sophisticated attacker. They require the business to be reachable and the gap to have gone unchecked — which describes most small business websites we've audited before any other work begins.
What This Actually Has to Do With Your Website
Translate the pattern above down to the scale of a typical small business site and it maps almost exactly. A contact form that collects names, phone numbers and project details is the same category of thing as a KYC database, just smaller — it still needs to be stored and transmitted properly. A login page for your CMS or admin panel is the same category of thing as the access point behind an incident like IndiaMART's. Your domain's email authentication records matter whether you send a few newsletters a month or run a national ISP, because the moment they're missing, anyone can send email that looks like it came from you. None of this requires thinking like a security company. It requires knowing which of these boxes are actually checked on your own site, rather than assuming they are.
The Checks You Can Run Yourself, Right Now
This is exactly why we built SiteSecure, a free scanner that runs 51 checks across four areas in under a minute: SSL/TLS configuration and security headers, DNS and email authentication (SPF, DKIM, DMARC), the OWASP Top 10 mapped to your site's detected technology stack, and core SEO and technical signals. It's passive — nothing on the site you scan is touched or changed — and it doesn't require creating an account to see the results.
Running it won't tell you whether you're the next Hathway or IndiaMART. It will tell you, specifically, which of the common gaps above actually apply to your own site today, which is the more useful question.
How TekyTec Approaches It
We built SiteSecure after noticing how often the same handful of gaps showed up during client onboarding, before any other work had started, and wanted business owners to be able to see that for themselves rather than wait on us to say so. It isn't a replacement for an ongoing IT consulting relationship if your business genuinely handles sensitive customer data, but it's a fast, honest way to find out where you stand before deciding whether you need one.
If a scan turns up something that needs more than a copy-paste fix, tell us what it found and we'll help you work out what actually matters first.
Sources: ISP Hathway's Database Breached, Over 4 Million Users Affected — MediaNama; Hacker Claims To Breach Indian ISP Hathway And Leaks Four Million Users' KYC Data — Cyware; 40,000+ Indian Online Marketplace Suppliers' Data Leaked — CloudSEK; IndiaMART data breach: 40,000 company records discovered on cybercrime forums — The Daily Swig.
Frequently Asked Questions
Is my small business website really a target for attackers?
Yes, though usually not in the sense of someone picking you out personally. Automated scanning tools check every publicly reachable website for the same handful of common gaps, regardless of size. A small site with a weak admin password or a missing security header is just as visible to those scans as a large one.
What actually caused the Hathway and IndiaMART breaches?
Neither has been confirmed in full technical detail by the companies involved. A hacker claimed to have obtained KYC data for roughly four million Hathway customers in January 2024, and researchers found around 40,000 IndiaMART vendor records on cybercrime forums in 2020. Both are cited here as well-documented, illustrative examples, not as current events.
What's the single most common security gap on a small business website?
Missing or misconfigured basics: no SPF, DKIM or DMARC records, which lets attackers send phishing email that appears to come from your own domain, missing security headers, or outdated software behind the site. None of these require an attacker to specifically target you — they just need you to be reachable.
Do I need a security team to be reasonably safe?
No. Most of what matters for a typical small business website is a short list of configuration checks, not ongoing security operations. The usual gap is that nobody has ever run through that list, not that it requires specialist staff.
How is SiteSecure different from just having an SSL certificate?
SSL/TLS is one of 51 checks SiteSecure runs. It also checks security headers, DNS email authentication, OWASP Top 10 risks mapped to your detected tech stack, and core SEO and technical signals. A valid certificate alone doesn't catch most of what shows up in a typical scan.
Where should I start if I've never checked any of this before?
Run a scan of your own domain and read through what comes back before changing anything. It takes under a minute and tells you exactly where you stand, which is more useful than guessing at what to fix first.