Aadhaar Data of 815M Indians Leaked

United States-based cybersecurity firm Resecurity has claimed in a report that personal data of around 815M Indians has been leaked on the dark web. India’s population is estimated at 1300M which means more than half the citizens now stand exposed. The leaked information includes names, phone numbers, addresses, Aadhaar, and passport details of Aadhaar registered users, which are available for sale online. On 9 Oct, a threat actor known as 'pwn0001' offered access to Aadhaar and Indian passport records on Breach Forums. Resecurity's investigators found that this threat actor was willing to sell the entire Aadhaar and Indian passport database for $80,000. There are suspicions that the compromised data may have originated from the Indian Council of Medical Research (ICMR) database. ICMR collected this data during the COVID-19 vaccine drive. In June 2023, another hacker disclosed the leak of personal data of over 80 crore Indians, which included COVID-19-related information. India's Information Technology minister said, ‘The government's Computer Emergency Response Team, or CERT, is investigating the matter.’ The minister did not confirm or comment on the size of the alleged leak, but said the government is working to ensure private data – whether collected by the center or state for administrative purposes, or by businesses for commercial reasons – is maintained in a ‘bullet proof ecosystem.’ But in 2018, when the Supreme Court had asked the government how it secures data, the answer was ‘behind thick walls.’ The government seems to have a shallow understanding of data security and is already shifting the blame for the leak on business entities.