Personal data of more than 815 million Indians, purportedly obtained from the Indian Council of Medical Research (ICMR), has been released online in what is being termed the country’s “biggest” data leak”, according to a report in News18. According to the article, Resecurity, an American cybersecurity and intelligence outfit, was the first to identify the breach. According to the cyber firm, a ‘threat actor’ using the handle ‘pwn001’ placed a posting on Breach Forums, a ‘top data breach debate and leaks site,’ allowing access to the Aadhaar details of 815 million (81.5 crore) Indians.
‘pwn001’ posted spreadsheets with four large leak samples with fragments of Aadhaar data
To put this in context, this is around ten times the entire population of Iran, Turkey, and Germany, the world’s 17th, 18th, and 19th most populous countries, respectively. India, on the other hand, has the world’s largest population of 1.43 billion people. ‘pwn001’ sold Aadhaar and passport information, as well as names, phone numbers, and addresses; the hacker claims these were acquired from COVID-19 test details of residents enrolled with ICMR.
As proof, ‘pwn001’ posted spreadsheets with four large leak samples with fragments of UID data. Upon analysis, these were identified as valid Aadhaar card IDs. While there has been no official comment from the ICMR or the government, the report adds that the Central Bureau of Investigation (CBI) is likely to investigate the situation if the ICMR files a complaint. In addition, the top personnel from numerous agencies and ministries have been enlisted. In addition, the necessary Standard Operating Procedure (SOP) has been implemented to control the damage.