New Delhi, June 1 (IANS) Security researchers have discovered that about 7.26 million records linked to users of mobile payments app BHIM were left exposed to the public by a website. The exposed data included sensitive information such as names, dates of birth, age, gender, home address, caste status and Aadhaar card details, among others, said the report from VPN review website vpnMentor. "The scale of the exposed data is extraordinary, affecting millions of people all over India and exposing them to potentially devastating fraud, theft, and attack from hackers and cybercriminals," the security researchers from vpnMentor wrote in a blog post on Sunday. The breach was closed late last month after the researchers contacted India's Computer Emergency Response Team (CERT-In) twice in a month's time. The BHIM website in question was developed by a company called CSC e-Governance Services LTD. in partnership with the Indian government. "In this case, the data was stored on an unsecured Amazon Web Services (AWS) S3 bucket," the researchers said, adding that S3 buckets are a popular form of Cloud storage across the world but require developers to set up the security protocols on their accounts. "We reached out to the website's developers to notify them of the misconfiguration in their S3 bucket and to offer our assistance. After not receiving a reply, we contacted India's Computer Emergency Response Team (CERT-In), which deals with cybersecurity in the country," they added. It appears CSC established the website connected to the misconfigured S3 bucket to promote BHIM usage across India and sign up new merchant businesses, such as mechanics, farmers, service providers, and store owners onto the app, according to the research led by vpnMentor's Noam Rotem and Ran Locar. The volume of exposed data which was first discovered by the security researchers on April 23 amounted to 409GB. "It's difficult to say precisely, but the S3 bucket seemed to contain records from a short period: February 2019. However, even within such a short timeframe, over 7 million records had been uploaded and exposed," said the report. "The exposure of BHIM user data is akin to a hacker gaining access to the entire data infrastructure of a bank, along with millions of its users' account information," it added. Offered by the National Payments Corporation of India (NPCI), the app BHIM, or Bharat Interface for Money, was launched in 2016. --IANS gb/na

7.26 million records of BHIM users data leaked: Report

New Delhi, June 1 (IANS) Security researchers have discovered that about 7.26 million records linked to users of mobile payments app BHIM were left exposed to the public by a website. The exposed data included sensitive information such as names, dates of birth, age, gender, home address, caste status and Aadhaar card details, among others, said the report from VPN review website vpnMentor. "The scale of the exposed data is extraordinary, affecting millions of people all over India and exposing them to potentially devastating fraud, theft, and attack from hackers and cybercriminals," the security researchers from vpnMentor wrote in a blog post on Sunday. Offered by the National Payments Corporation of India (NPCI), the app BHIM, or Bharat Interface for Money, was launched in 2016. In a statement on Monday, the NPCI said that "there has been no data compromise at BHIM App." "We have come across some news reports which suggest data breach at BHIM App. We would like to clarify that there has been no data compromise at BHIM App and request everyone to not fall prey to such speculations. NPCI follows high level of security and an integrated approach to protect its infrastructure and continue to provide a robust payments ecosystem," said the NPCI. In its report, vpnMentor also said that the website that leaked the data was developed by a company called CSC e-Governance Services LTD. in partnership with the Indian government. The issue was resolved late last month after the researchers contacted India's Computer Emergency Response Team (CERT-In) twice in a month's time. "In this case, the data was stored on an unsecured Amazon Web Services (AWS) S3 bucket," the researchers said, adding that S3 buckets are a popular form of Cloud storage across the world but require developers to set up the security protocols on their accounts. "We reached out to the website's developers to notify them of the misconfiguration in their S3 bucket and to offer our assistance. After not receiving a reply, we contacted India's Computer Emergency Response Team (CERT-In), which deals with cybersecurity in the country," they added. It appears CSC established the website connected to the misconfigured S3 bucket to promote BHIM usage across India and sign up new merchant businesses, such as mechanics, farmers, service providers, and store owners onto the app, according to the research led by vpnMentor's Noam Rotem and Ran Locar. The volume of exposed data which was first discovered by the security researchers on April 23 amounted to 409GB. "It's difficult to say precisely, but the S3 bucket seemed to contain records from a short period: February 2019. However, even within such a short timeframe, over 7 million records had been uploaded and exposed," said the report. "The exposure of BHIM user data is akin to a hacker gaining access to the entire data infrastructure of a bank, along with millions of its users' account information," it added. --IANS gb/na

7.26 million records of BHIM user data leaked: Report

Mansi Thapliyal/ReutersA villager goes through the process of eye scanning for Unique Identification (UID) database system in India.If you're an Indian citizen, chances are you're well-acquainted with a government program that scans people's fingerprints and irises and uploads the data to a federal database. If you don't comply, you risk losing the ability to pay your taxes, collect welfare money, and access other government assistance programs.And if you're unlucky, you might even lose the ability to stay private, as hackers could use the data to trace your phone calls, messages, and physical location.This is the reality for India's 1.3 billion people, who since 2009 have been asked to comply with an ID-collection system the government bills as voluntary, but only if people don't mind forgoing basic civic entitlements, <a href="http://www.latimes.com/world/la-fg-india-database-2017-story.html?utm_source=feedburner&amp;utm_medium=feed&amp;utm_campaign=Feed%3A+GreenspaceEnvironmentBlog+%28Greenspace%29">the Los Angles Times reports</a>. The program, known as Aadhaar, or "foundation" in Hindi, seeks to log every person's identity using biometric data collected at various "enrollment agencies" scattered around the country - primarily in an effort to cut down on instances of fraud and counterfeiting.Over the last eight years, the government has moved a growing number of transactions to the Aadhaar bucket. Most recently, it said people could file their income taxes <a href="http://www.hindustantimes.com/business-news/now-aadhaar-a-must-to-file-income-tax-returns-and-apply-for-pan-card/story-71CBEXGGD8yd9iFjUn4oNI.html">only if they had first registered</a> with Aadhaar, Hindstan Times reports.Mansi Thapliyal/ReutersVillage women stand in a queue to get themselves enrolled for the Unique Identification (UID) database system at Merta district in the desert Indian state of Rajasthan.Similar to criticisms raised in the US over voter ID laws, critics of Aadhaar worry what will happen to India's rural poor if they can't visit an enrollment center to join.Aadhaar's proponents say the system actually makes life more convenient for Indian citizens. Historically, people have needed a stack of documents - bills, ID cards, tax forms - to prove their identity. Aadhaar replaces all those with one quick thumb scan. Instantly, the bank teller knows you're who you say you are, and your pockets remain as empty as ever.Mansi Thapliyal/ReutersThe Indian government has begun to use Aadhaar to make direct cash transfers to the poor, in an attempt to cut out frauds who siphon billions of dollars from welfare schemes.Prime Minister Narendra Modi views Aadhaar as part his ongoing mission to upgrade India's technology.On November 8, Modi issued a ban on 86% of Indian paper currency - a ban that took effect just four hours later - over fears that most of the currency was earned illegally or used for illicit means. He called it "black money," and gave Indians until December 30 to trade in their old notes for new ones. The country has been holding <a href="http://www.businessinsider.com/india-electronic-lottery-cash-crisis-2016-12">a massive recurring lottery</a> ever since to entice people to join a new electronic system, which lets people pay via digital ID badges."Our objective is to make digital payments a huge mass movement in this country," Amitabh Kant, CEO of the state-run think tank NITI Aayog, <a href="http://money.cnn.com/2016/12/15/news/india/india-digital-payment-cash-lottery/index.html?iid=hp-stack-dom">told CNN</a> in December 2016, when the lottery launched.Whether Aadhaar ends up being labeled a success likely depends on politics. India's government insists the program adds greater accountability to the many social services it oversees. But critics argue those goals are better served through less intrusive means, such as reforming welfare programs.An Indian think tank, for instance, recently found personal data of <a href="http://cis-india.org/internet-governance/information-security-practices-of-aadhaar-or-lack-thereof-a-documentation-of-public-availability-of-aadhaar-numbers-with-sensitive-personal-financial-information-1">135 million people</a> is available on unsecure websites. If an opportunistic hacker were to grab that data for nefarious means, in theory they could use it to pose as whomever they wanted. As one member of the think tank told the LA Times, stolen credit cards can be replaced. Biometric data is forever. <h3>NOW WATCH: <a href="http://www.businessinsider.com/martin-gilbert-aberdeen-asset-management-india-most-attractive-emerging-market-2017-5">A $385 billion fund CEO on why he is pumped about India</a></h3> Please enable Javascript to watch this video

India is scanning people's fingerprints and eyeballs to make a database of every citizen

Moody's Investors Service on Monday downgraded India's sovereign credit rating for the first time in more than two decades, saying policymakers will be challenged to mitigate risks of <keyword id="1032787" type="PERSON" weightage="20" keywordseo="low-growth">low growth</keyword>, deteriorating fiscal position and <keyword id="9329640" type="UNKNOWN" weightage="20" keywordseo="financial-sector-stress">financial sector stress</keyword>. Downgrading India's rating by a notch to 'Baa3' from '<keyword id="2556110" type="COMPANY" weightage="20" keywordseo="Baa2">Baa2</keyword>' assigned in November 2018, Moody's estimated India GDP shrinking by 4 per cent -- first full fiscal contraction in more than four decades, as the country faces a prolonged period of slower growth. Accordingly, India's foreign-currency and local-currency long-term issuer ratings have been downgraded to Baa3 from Baa2. India's local-currency senior unsecured rating too has been lowered to Baa3 from Baa2, and its short-term local currency rating to P-3 from P-2. The outlook remains negative. "The decision to downgrade India's ratings reflects Moody's view that the country's policymaking institutions will be challenged in enacting and implementing policies, which effectively mitigate the risks of a sustained period of relatively low growth, significant further deterioration in the general government fiscal position and stress in the financial sector," Moody's said. 'Baa3' rating is the lowest investment grade -- just a notch above 'junk' status. Moody's had last downgraded India's rating in 1998. The negative outlook reflects dominant, mutually-reinforcing, downside risks from deeper stresses in the economy and financial system that could lead to a more severe and prolonged erosion in fiscal strength than Moody's currently projects, it added. Moody's said slow reform momentum and constrained policy effectiveness have contributed to a prolonged period of slow growth, compared to India's potential, that started before the COVID-19, and it expects this to continue well beyond the <keyword id="43587" type="ORGANIZATION" weightage="20" keywordseo="pandemic">pandemic</keyword>. Moody's said India faces a prolonged period of slower growth relative to the country's potential, rising debt, further weakening of debt affordability and persistent stress in parts of the financial system, all of which policymaking institutions will be challenged to mitigate and contain. The agency said its upgrade of India's ratings to Baa2 in November 2017 was based on the expectation that effective implementation of key reforms would strengthen sovereign's credit profile through a gradual but persistent improvement in economic, institutional and fiscal strength. "Since then, implementation of these reforms has been relatively weak and has not resulted in material credit improvements, indicating limited policy effectiveness," Moody's said. It said the decision to downgrade India's rating was taken in the context of the <keyword id="1754604" type="PERSON" weightage="20" keywordseo="coronavirus">coronavirus</keyword> pandemic, but was "not driven" by the impact of the pandemic. Rather COVID-19 pandemic amplifies vulnerabilities in India's credit profile that were present and building prior to the shock, and which motivated the assignment of a negative outlook last year. "Although a rating upgrade is unlikely in the near future, Moody's would change the outlook on India's rating to stable if outturns and policy actions were to raise confidence that real and nominal growth will rise to sustainably higher rates than Moody's projects, including through measures which enhance financial stability by strengthening the supervision, regulation and capitalisation of the financial sector. "Commensurate action to halt and reverse the rise in the debt trajectory, even slowly, would also support a stable outlook. Further, evidence that self-reinforcing economic and financial risks are rising would put downward pressure on the rating," Moody's said. Real GDP growth has declined from a high of 8.3 per cent in fiscal 2016 (ending March 2017) to 4.2 per cent in fiscal 2019. Moody's expects India's real GDP to contract by 4 per cent in fiscal 2020 due to the shock from the coronavirus pandemic and related lockdown measures, followed by 8.7 per cent growth in fiscal 2021 and closer to 6 per cent thereafter. Two other global rating agencies -- S&amp;P and Fitch -- too has projected Indian economy to shrink by 5 per cent in the current fiscal. The rating downgrade brings Moody's sovereign rating on India on par with S&amp;P and Fitch, which rate India at 'BBB-', the lowest investment grade. Thereafter and over the longer term, growth rates are likely to be materially lower than in the past, due to persistent weak private sector investment, tepid job creation and an impaired financial system. In turn, a prolonged period of slower growth may dampen the pace of improvements in living standards that would help support sustained higher investment growth and consumption. "While the government responded to the growth slowdown prior to the coronavirus outbreak with a series of measures aimed at stimulating domestic demand, and recently announced a support package aimed at supporting India's most vulnerable households and small businesses, Moody's does not expect that these measures will durably restore real GDP growth to rates around 8 per cent, which had seemed within reach just a few years ago," the US-based rating agency said. Moody's does not expect the credit crunch in India's undercapitalised financial sector to be resolved quickly. In turn, subdued growth further challenges the banking system's incomplete resolution of legacy non-performing assets and governance reforms, and is likely to further weaken asset quality and the health of banks as well as NBFIs. It said India's debt burden, which was 72 per cent of GDP in fiscal 2019, will rise to 84 per cent of GDP in 2020. Measures to improve India's fiscal strength, which were at the heart of the government's policy framework a few years ago, have "underwhelmed". Fiscal performance in recent years has been weaker than expected, with fiscal deficit targets consistently missed and a persistent lack of clarity on how medium-term fiscal consolidation objectives would be achieved, the agency said. SEE ALSO: <a href="https://www.businessinsider.in/stock-market/news/small-businesses-with-good-turnover-can-now-be-listed-and-the-indian-government-will-buy-the-shares/articleshow/76136857.cms" data-type="tilCustomLink">Small businesses with ‘good turnover’ looking to get listed on the stock market will have the Indian government will buying their shares</a> <a href="https://www.businessinsider.in/tech/news/bhim-app-left-aadhaar-cards-pan-numbers-and-biometric-information-exposed/articleshow/76135419.cms" data-type="tilCustomLink">CSC BHIM site left Aadhaar cards, PAN numbers, and biometric information exposed — could be used to carry out financial fraud and identity theft, says report</a>

Moody's downgrades India's rating first time in over 2 decades, says GDP to shrink by 4% in FY21

Post <a href="http://www.businessinsider.in/searchresult.cms?query=demonetisation&amp;sortorder=effectivedate">demonetisation</a>, digital payment companies have been enjoying the good days as their businesses flourished exponentially. Now such companies are looking forward to better things in the upcoming <a href="http://www.businessinsider.in/searchresult.cms?query=Union+Budget+&amp;sortorder=effectivedate">Union Budget</a> to ensure customers stick to <keyword id="6358577" type="UNKNOWN" weightage="100" keywordseo="Digital-Payments">digital payments</keyword> instruments and don’t migrate back to cash. 
 
The whole sector is hopeful that center, in a bid to drive cashless economy, will follow the <a href="http://www.businessinsider.in/searchresult.cms?query=South+Korea&amp;sortorder=effectivedate">South Korea</a> model where their government succeeded to switch a major chunk of payments in the country to digital means through <keyword id="6358231" type="UNKNOWN" weightage="100" keywordseo="tax-benefits">tax benefits</keyword> for both merchants and consumers. 
 
“The government of South Korea did the maths around the fact that the number of people coming into the tax nets incrementally because of digital payments and the cost of cash to the GDP reducing would offset the temporary hit that they had in terms of tax payments. I think this would be not only sustainable but also of great attraction for Indians who are careful about saving taxes under investments, home loans, etc,” TR Ramachandran, group country manager, India and South Asia for Visa, told ET. 
 
The whole payment industry has been meeting Finance Minister Arun jaitley and it is said that they have presented various case studies of different countries to showcase a direct relation between tax benefits and uptick of digital transactions. 
 
“Tax benefits from both sides — merchants as well as consumers — will get more people to transact digitally. Merchants can get discount on service tax, sales tax, etc. while consumers can get benefits on income tax,” Paresh Rajde, founder of Mumbai-based domestic remittance and payments company Suvidhaa Infoserve, told ET. 
 
Reportedly, Mastercard has said that the government should focus on small merchants and promote digital payments among them to address issues around credit underwriting and onboarding for this sector. 
 
“One of the biggest resistance factors for consumers to adopt electronic payments is their fears around safety and security. It is critical that the government take the safety and security agenda very seriously and invest in technology and fraud protection tools,” Porush Singh, country corporate officer and division president South Asia for Mastercard, told ET. 
 
According to people with knowledge in the field, major reason why merchants and small shopkeepers prefer to transact in cash is because they want to avoid tax net. Hence if they are given tax benefits on accepting payments digitally there would be more number of people taking it up. 
 
The industry has also requested for extension of the import duty waiver on PoS terminals for card payments beyond March 31as it expects the demand for such terminals to go up. While industry executives seek more support from the government to promote digital payments, there is also talk around some mention of cyber security as there are security concerns around digital payments. 
 
“Everything that the government has announced, from UPI payments to Aadhaar authentication, there are huge security concerns around its implementation,” said Bhavin Turakhia, chief executive at payments technology company Zeta. “The government needs to recognise such concerns for both cards as well as UPI,” he said.

You Searched For "aadhaar card fraud" and got 5 results

7.26 million records of BHIM users data leaked: Report

IANS

7.26 million records of BHIM user data leaked: Report

IANS

India is scanning people's fingerprints and eyeballs to make a database of every citizen

Chris Weller

Moody's downgrades India's rating first time in over 2 decades, says GDP to shrink by 4% in FY21

PTI

Digital payments businesses are hoping for tax benefits from Budget 2017

BI India Bureau