Biggest Data Theft in India's History

An American cybersecurity and intelligence agency, Resecurity, has issued an alert about a potential data breach involving Aadhaar and passport information of over 815 million Indian citizens. The alert, which was posted by a threat actor known as 'pwn0001' on 'Breach Forums' on October 9, 2023, has raised concerns about the security of sensitive personal data for a significant portion of India's population, which stands at just over 1.486 billion people.

Resecurity's report states that "HUNTER investigators established contact with the threat actor and learned they were willing to sell the entire Aadhaar and Indian passport dataset for $80,000." However, it remains unclear how the data was initially leaked on the dark web.

The dataset comprises various fields related to Indian citizens, including names, father's names, phone numbers, passport numbers, Aadhaar numbers, age, gender, addresses, and pincodes.

Additionally, 'pwn0001' shared spreadsheets with fragments of Aadhaar data as proof. One of these samples contained 100,000 records of Personally Identifiable Information (PII) related to Indian residents, with the report confirming that the Aadhaar Card IDs were valid, as verified through the government's "Verify Aadhaar" portal.

Another incident reported in the Resecurity document occurred on August 30, 2023, when a threat actor named 'Lucius' posted a thread on Breach Forums promoting a 1.8 terabyte data leak, which included a database of India's internal law enforcement organization. This dataset featured details such as names, phone numbers, addresses, national ID numbers, and relative names.

The leak by 'Lucius' contained a more extensive array of PII data compared to 'pwn0001.' In addition to Aadhaar IDs, it included Voter IDs and driving license records, as stated in the Resecurity report.

This significant breach of Indian PII data on the 'Dark Web' poses a severe risk of digital identity theft. Cybercriminals targeting India can exploit these stolen credentials to conduct various financially motivated scams, including online banking theft and e-tax refund fraud.

Cyberattacks targeting government platforms have been on the rise in India recently. Earlier this year, the government's Parivahan website suffered a data breach, exposing its source code and sensitive data of 10,000 users. In another incident, the Aadhaar or passport numbers of COVID-vaccinated beneficiaries were being sold via Telegram by a threat actor.

These developments underscore the urgent need for enhanced cybersecurity measures and data protection in India to safeguard the personal information of its citizens.