Best printers for Home

Best Mixer Grinder

Best wired Earphones

Best 43 Inch TV in India

Best Wi Fi Routers

Best Home Theatre in India

Smart Watch under 5000

Best Laptops for Education

Best Laptop for Students

<ul><li>Personal data of thousands of Indians has reportedly been leaked from the CoWIN portal.</li><li>According to a report, details such as name, ID proof, gender and more have been leaked.</li><li>The data has been spotted on <keyword id="1275203" type="General" weightage="100" keywordseo="telegram" source="Orion">Telegram</keyword> and a bot sends the data when you send the user’s phone number.</li></ul>In what could be a major data breach, personal information of people who received the Covid-19 vaccine has reportedly been leaked online. This data includes the user’s name, date of birth, gender, and their ID. According to a report by Malayala Manorama, the data has been leaked through the CoWIN portal that was designed to help citizens book their vaccine slots. As per the report, all you need to do is enter the phone number of a person who has received the Covid-19 vaccine on a Telegram bot and it will fetch important details about the user. This, as per the report, has put important data such as Aadhaar, PAN, voter ID and passport of thousands of users at risk. The government has not revealed anything about the leak yet. <div type="twitter" handle="SaketGokhale" handlename="SaketGokhale" favoritecount="0" retweetcount="0" id="1668104757704269824"></div> Trinamool Congress (TMC) spokesperson Saket Gokhale has <a href="https://twitter.com/SaketGokhale/status/1668104757704269824">shared</a> screenshots of the Telegram bot, with vaccination information of people like P Chidambaram, Jairam Ramesh and Derek O Brien. <cmsannotation type="cmsannotation" annotationid="Not the first Covid-19 related data leak" comment="subhead" text="Not the first Covid-19 related data leak">Not the first Covid-19 related data leak</cmsannotation> This is not the first time that CoWIN data has come under the scanner. In 2022, data of over 20,000 people, including their name, mobile number, Covid-19 test result and their address was<a href="https://www.hindustantimes.com/india-news/data-meant-for-cowin-portal-leaked-online-over-20-000-indians-likely-affected-101642767559692.html"> reportedly</a> leaked. This data was meant to be uploaded on the CoWIN platform. In another instance, data of over 15 crore citizens was<a href="https://www.timesnownews.com/technology-science/article/cowin-apps-covid-19-vaccination-data-of-15-crore-users-leaked-and-up-for-sale-government-denies-breach/769434"> reportedly</a> leaked in 2021 and the hackers put the data on sale. The government however refuted the claim and said that the CoWIN platform was never hacked. SEE ALSO: <a href="https://www.businessinsider.in/tech/news/vision-pro-to-ios-17-apples-top-six-announcements-at-wwdc-2023/articleshow/100786632.cms">Vision Pro to iOS 17: Apple’s top six announcements at WWDC 2023</a> <a href="https://www.businessinsider.in/finance/news/2000-note-withdrawal-how-to-exchange-notes-is-it-a-legal-tender-and-other-questions-answered/articleshow/100412941.cms">₹2,000 note withdrawal – How to exchange them, is it a legal tender and other questions answered</a> <a href="https://www.businessinsider.in/tech/news/apple-app-store-prevented-over-2-billion-in-fraudulent-transactions-last-year-banned-282-million-user-accounts/articleshow/100322718.cms">Apple App Store prevented over $2 billion in fraudulent transactions last year, banned 282 million user accounts</a>

Covid-19 vaccination data reportedly leaked – ID proof, date of birth and other details available on Telegram

<ul><li>The CSC <keyword id="9325628" type="UNKNOWN" weightage="20" keywordseo="BHIM-data-breach">BHIM data breach</keyword> includes extremely sensitive information like Aadhaar details with complete scans of the Aadhaar cards, biometric details, addresses, date of birth and more.</li><li>In total, over 7 million records of millions users were exposed.</li><li>CERT-In, which was notified of the leak on May 5, had reportedly fixed it on May 22.</li></ul>Over 7 million records of user transactions on the CSC BHIM website were left unsecured as per a report Israeli cybersecurity website vpnMentor. These records include Aadhaar card numbers, PAN numbers, and even biometric details in a data bundle of 409 GB. According to the <a href="https://www.vpnmentor.com/blog/report-csc-bhim-leak/">report</a>, the CSC BHIM data breach includes personal data such as Aadhaar details, addresses, bank records, caste certificate and a complete personal profile of the users. <div type="Article" hostid="261" msid="63924186" title="Indian government portal leaks 8.9mn Aadhaar details, again" mstype="2" mssubtype="0"></div> The data breach has since been patched up but the data was out there for anyone who knew where to look for over a year. However, the National Payments Corporation of India denies that there has been any incident. “We would like to clarify that there has been no data compromise at <keyword id="4013165" type="PERSON" weightage="20" keywordseo="BHIM-app">BHIM App</keyword> and request everyone to not fall prey to such speculations. NPCI follows high level of security and an integrated approach to protect its infrastructure and continue to provide a robust payments ecosystem,” it said. How bad is the BHIM data breach? The cybersecurity researchers believe that the combination of data left exposed could give hackers the ability to carry out identity theft, tax fraud, monetary theft, among other illegal activities. The research team led by Noam Rotem and Ran Locar describe the data breach as being akin to a hacker gaining access to the entire data infrastructure of a bank and detailed information about its users’ account information. “The sheer volume of sensitive, private data exposed, along with UPI IDs, document scans, and more, makes this breach deeply concerning,” said the report explaining the seriousness of the data breach. They assert that using the above details of the personal data about an individual, from their names and dates of birth to biometric details and ID numbers, could give third-party onlookers a complete profile of an individual — including a look into their finances and banking records. “It would be incredibly valuable to hackers… This data would make illegally accessing those accounts much easier,” said the report. With complete profiles of BHIM users being leaked, it leaves them extremely vulnerable to all sorts of frauds and theft. The risks for affected users can exceed just monetary loss – there is a high risk of identity theft, especially since almost all personal data has been exposed. “The scale of the exposed data is extraordinary, affecting millions of people all over India and exposing them to potentially devastating fraud, theft, and attack from hackers and cybercriminals,” it added, suggesting that the breach is likely very invasive. How and when was BHIM UPI’s data breached? The cybersecurity researchers claim that 409 GB of data was stored on an unsecured Amazon Web Services (AWS) S3 bucket exposing records from February 2019. “S3 buckets are a popular form of cloud storage across the world but require developers to set up the security protocols on their accounts,” said the report. The research team at vpnMentor discovered the BHIM data breach on April 23 and contacted India’s Computer Emergency Response Team (CERT-In) on May 5. The data leak was finally fixed by the authorities on May 22, leaving the breach exposed for an entire month after it was discovered. <table style="border-width: initial; border-style: none; width: 451.276pt; table-layout: fixed;"></colgroup><tbody><tr><td colspan="2" style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;">Timeline of the data breach </td></tr><tr><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;">Date discovered </td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;">April 23, 2020 </td></tr><tr><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;">Contact with CERT-In </td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;">April 28, 2020 </td></tr><tr><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;">Response from CERT-In </td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;">April 29, 2020 </td></tr><tr><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;">Contact with company </td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;">May 5, 2020 </td></tr><tr><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;">Second contact with CERT-In </td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;">May 22, 2020 </td></tr><tr><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;">Data of rectification </td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;">May 22, 2020* </td></tr></tbody></table> *Assumed day of rectification after no reply from CERT-In Source: VPNMentor What can you do? Unfortunately, there’s not much you can do on your end right now. If you are unsure about your data safety, you can contact CSC e-Governance Services, which is a special division set up under the Ministry of Electronics &amp; IT. The NPCI maintains that their systems are robust and no data breach occurred to begin with despite evidence posted by the vpnMentor's cybersecurity team. SEE ALSO: <a href="https://www.businessinsider.in/indian-government-portal-leaks-8-9mn-aadhaar-details-again/articleshow/63924186.cms">Indian government portal leaks 8.9mn Aadhaar details, again</a> <a href="https://www.businessinsider.in/slideshows/here-are-the-most-controversial-data-breaches-of-2018-that-affected-indian-users/slidelist/67155541.cms">Here are the most controversial data breaches of 2018 that affected Indian users</a> <a href="https://www.businessinsider.com/r-new-data-leak-hits-indias-national-id-card-database-aadhaar-zdnet-2018-3?IR=T">New data leak hits India's national ID card database Aadhaar: ZDNet</a>

CSC BHIM site left Aadhaar cards, PAN numbers, and biometric information exposed — could be used to carry out financial fraud and identity theft, says report

<ul><li><keyword id="3489555" type="PERSON" weightage="20" keywordseo="upstox">Upstox</keyword>, the second largest stock broker in India, has suffered a massive data breach.</li><li>This breach has exposed user data like Aadhaar, PAN, bank account numbers and more.</li><li>While Upstox did not comment on the data leak, it said it has upgraded its security systems ‘manifold’ on the recommendations of a global cyber-security firm.</li></ul> Popular discount broker Upstox has suffered a massive data breach that has exposed some important data like Aadhaar, PAN and bank account numbers, apart from other personally identifiable information like mobile numbers and email addresses. Upstox is a Delhi-based discount stock broker that allows its customers to buy and sell shares. It is backed by Tiger Global and has over <a href="https://economictimes.indiatimes.com/markets/stocks/news/what-made-upstox-indias-second-largest-stockbroker-after-zerodha/articleshow/78745921.cms">1 million customers</a>. “We have upgraded our security systems manifold recently, on the recommendations of a global cyber-security firm. We brought in the expertise of this globally renowned firm after we received emails claiming unauthorised access into our database,” Upstox <a href="https://upstox.com/announcements/customer-support/security-measures/">said</a> on its website, reacting to reports of the data breach. The company said that despite the data breach, the funds and shares of its customers are safe. This is for two reasons – funds in your Upstox account can only be withdrawn to the linked bank account, and the shares are held with the depositories – either Central Depositories Services India Ltd (CDSL) or National Securities Depository Ltd (NSDL) – and not with Upstox. With that being said, Upstox users have other things to be worried about. Security researcher Rajshekhar Rajaharia, who <a href="https://www.businessinsider.in/tech/news/over-100-million-debit-and-credit-card-users-data-has-been-leaked-online-from-payments-processor-juspay-amazon-and-swiggy/articleshow/80096472.cms">had earlier tipped Business Insider about Juspay</a> and MobiKwik data breaches, told us that the <keyword id="11082460" type="UNKNOWN" weightage="20" keywordseo="Upstox-data-breach">Upstox data breach</keyword> includes Aadhaar, PAN, passport, bank account numbers, mobile numbers and even the photos of signatures. This data could be used by hackers or malicious parties to impersonate users and transact on their behalf without the users’ knowledge. According to Rajaharia, the Upstox data breach was executed due to a compromised Amazon Web Service (AWS) key used by the company. He says that the same AWS key vulnerability was exploited in the MobiKwik data breach as well. Rajaharia shared a data sample with us – the sample revealed user details as reported in the breach. However, we could not verify the authenticity of the sample. The hacking group, ShinyHunter, has taken down the data for now. Upstox is the latest in Indian companies being targeted by hackers The Upstox data breach is the latest in a string of Indian companies being hacked – the most recent ones were MobiKwik, Juspay, ClickIndia, ChqBook, WedMeGood, among others. However, this time around, the Upstox data breach could be a result of its own folly. SEE ALSO: <a href="https://www.businessinsider.in/tech/news/over-100-million-debit-and-credit-card-users-data-has-been-leaked-online-from-payments-processor-juspay-amazon-and-swiggy/articleshow/80096472.cms">The company that processes payments for Amazon and Swiggy has reported a data leak of over 100 million debit and credit cardholders</a> <a href="https://www.businessinsider.in/tech/news/these-were-the-biggest-cyber-attacks-of-2020/slidelist/79941232.cms">From FireEye to Twitter to Covid-19 vaccine research ⁠— these were the biggest cyber attacks of 2020</a>

Discount broker Upstox suffers data breach – Aadhaar, PAN and bank account numbers leaked

Here are the most controversial data breaches of 2018 that affected Indian users

<ul><li><keyword id="44604" type="PERSON" weightage="20" keywordseo="Nandan-Nilekani">Nandan Nilekani</keyword>, Infosys co-founder and the architect of the world’s largest biometric system, was just appointed by India’s central bank to improve the adoption of digital payments in the country. </li><li>Despite numerous attempts by the Indian government, cashless payments dipped once cash was available after Prime Minister Narendra Modi’s demonetisation exercise. </li><li>There are numerous challenges ahead for Nilekani including addressing the level of digital literacy in the country and keeping digital payments affordable.</li></ul>India now has 800 million mobile phone users but merely a fraction are using digital payments. The <keyword id="6354335" type="ORGANIZATION" weightage="20" keywordseo="reserve-bank-of-india">Reserve Bank of India</keyword> has brought none other than Nandan Nilekani, the architect of the world’s largest biometric identity system, the <keyword id="144117" type="ORGANIZATION" weightage="20" keywordseo="AADHAAR">Aadhaar</keyword>, after several attempts to push Indians to go cashless fell short of the government’s goal. While the infamous demonetisation in November 2016, which aimed at pushing Indians to use digital payments, gave a temporary fillip to mobile wallets — the momentum wasn’t maintained once banks had enough cash to dispense. According to the government think tank, Niti Aayog, the digital payment market is set to reach $1 trillion by 2023.However, Nilekani, an entrepreneur-turned-techocrat, has his task cut out for him and it’s not an easy one. 
 <div type="ExtQuote" text="The five-member panel on deepening of digital payments has been constituted with a view to encourage digitisation of payments and enhance financial inclusion through digitisation." auname="Reserve Bank of India, press statement"></div>



 More internet penetration, but is it enough More people in India have access to internet in India than ever before but the infrastructure and connectivity is far from ideal, more so outside the big cities — even with credit or debit card transactions. Even when demonetisation took place, PayTM — one of India’s most-used <keyword id="6358031" type="PERSON" weightage="20" keywordseo="digital-wallets">digital wallets</keyword> — <a href="https://www.exchange4media.com/marketing-news/paytm-faces-multiple-challenges-ata-crucial-juncture-of-its-journey-67263.html">crashed</a> under the sudden increase in traffic. Force of habit It’s not about knowing that you can make payments using the internet, it’s also about habit. In rural areas, due to the lack of infrastructure and appropriate incentives — going to the bank or to the market is still easier and cheaper than shopping online. Limited digital literacy The biggest hurdle in the committee’s way isn’t access to internet but digital literacy. Educating the masses so that they are able to use these apps will be a prerequisite. Even among those who are familiar with digital modes, a large section of Indians are still paranoid about the safety of online transactions. The question of security A report by Qualcomm states that a lot of wallets and banking apps in India lack the requisite hardware security. And since they run on Android accommodating versions that lack the latest security updates, they are relatively more vulnerable to being hacked. The question isn’t only of alphanumeric passwords but also biometrics, like your fingerprint. Even one of <keyword id="30067" type="ORGANIZATION" weightage="20" keywordseo="RBI">RBI</keyword>’s mandate is speaks to that regard. 
 <div type="ExtQuote" text="Suggest measures to strengthen the safety and security of digital payments and a roadmap for increasing customer confidence and trust while accessing financial services through digital modes." auname="Reserve Bank of India, press statement"></div>



 Security and trust are two different things Even with best security in place, the people will only use digital payments if there’s trust. The recent data leaks and reports of insider fraud at PayTM have not helped that cause. Most people prefer cash in the country because it doesn’t leave a digital footprint under the perception that having every transaction scrutinized could lead to more trouble. Nilekani, one of the founders of Indian tech services major Infosys, is often eulogized for creating the Aadhaar framework, but notwithstanding the magnitude of the exercise, the unique identity project has had its share of chinks. The Tribune, when looking into the security of the Aadhar database, found that they could attain all the details about a person using the 12-digit unique identification number after <a href="http://www.tribuneindia.com/news/nation/rs-500-10-minutes-and-you-have-access-to-billion-aadhaar-details/523361.html">paying an agent</a> ₹500. For another ₹300, you get a physical copy of the Aadhaar card, which could then be used to access various government schemes. Robert Baptiste, a french researcher known by online Twitter handle ‘Elliot Alderson’, was <a href="https://twitter.com/fs0c131y/status/973482430903586816?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E973482430903586816&amp;ref_url=https%3A%2F%2Fwww.businessinsider.in%2Findian-government-portal-leaks-8-9mn-aadhaar-details-again%2Farticleshow%2F63924186.cms">able to</a> hack into the Aadhaar app in under a minute. Another twitter user, Srinivas Kodali, <a href="https://www.businessinsider.in/indian-government-portal-leaks-8-9mn-aadhaar-details-again/articleshow/63924186.cms">exposed</a> how 8.9 million Aadhaar numbers were vulnerable. Aadhaar was still a mode for people to receive government benefits and cash transfer. It will take a lot more time and effort to convince penny-wise Indians to risk their money in digital payment apps.

Can Nilekani, the architect of the world’s largest biometric project, spark digital payments in India?

<ul><li>Two consecutive leaks from Kodali of Aadhaar numbers</li><li>Posted leaked numbers on Twitter</li><li>Database maybe secure but government portals need additional security</li></ul>Two new cases have come to light with a total of 8.9 million Aadhaar numbers of MGNREGA beneficiaries leaked through the Andhra Pradesh Benefit Disbursement Portal. The details were spotted by Srinivas Kodali, also known as @digitaldutta, who published screenshots on Twitter. 
 
 
 
 
 <div type="javascript" title="Custom"><cdata><![CDATA[


]]></cdata></div>










His earlier tweet shows how people’s Aadhar numbers are being to used to collate data on their location, religion, caste, phones numbers and bank account numbers. 
 
 
 
 
 <div type="javascript" title="Custom"><cdata><![CDATA[


]]></cdata></div>










The first leak by Kodali was from the Andhra Pradesh State Housing Corporation. It showed an even grimmer reality of how Aadhar numbers are being linked to caste, the type of house a person lives in and the extent of damage it has suffered. 
 
 
 
 
 <div type="javascript" title="Custom"><cdata><![CDATA[


]]></cdata></div>










Since then, he has reported the issue to the authorities, but his <a href="https://thenewsminute.com/article/13-lakh-aadhaar-numbers-leaked-andhra-govt-website-linked-personal-details-80178">fear</a> is that the surveys conducted in Andhra and Telangana have allowed citizens to carry phones and biometric readers, collecting private information on almost every individual. Not the first time Most recently, Karan Saini, a security researcher, told <a href="https://www.zdnet.com/article/another-data-leak-hits-india-aadhaar-biometric-database/">ZDNet</a> that <keyword id="6356006" type="UNKNOWN" weightage="20" keywordseo="Aadhaar-card">Aadhaar card</keyword> information could be obtained through Indane’s system, a state-owned utility company. According to them, they tried to contact the authorities for over a month through several avenues but to no avail. The affected endpoint was only pulled offline once the story had gone live. <a href="http://www.tribuneindia.com/news/nation/rs-500-10-minutes-and-you-have-access-to-billion-aadhaar-details/523361.html">The Tribune</a> also looked into the Aadhaar database and found that they could attain all the details about a person by typing in the 12-digit unique identification number once they paid an agent ₹500 (approximately $8). For another ₹300 (approximately $5), that same individual could even print out a copy the Aadhaar card, which could then be used to access various government schemes. Even the Android Aadhaar app was <a href="https://www.indiatimes.com/technology/news/french-cyber-expert-cracks-official-aadhaar-app-in-1-minute-realizes-uidai-s-worst-nightmare-341416.html">hacked</a> by Robert Batiste, a french researcher, in under a minute. 
 
 
 
 <div type="javascript" title="Custom"><cdata><![CDATA[


]]></cdata></div> That said, Aadhaar breaches haven’t been directly through the Aadhaar database, but through various government portals and third-parties. So, Ajay Bushan Pandey, CEO of <keyword id="6355252" type="DEFINITION" weightage="20" keywordseo="uidai">UIDAI</keyword>, wasn’t incorrect when he said that there have been no data leaks from the UIDAI database. The Aadhaar card system, in its usage, is more than just the database. There’s a wide ecosystem to be take in to account where security concerns are yet to be addressed. A secure database doesn’t necessarily imply security of information since so much of it exists outside the Aadhaar database itself.

Indian government portal leaks 8.9mn Aadhaar details, again

<ul><li>The State Bank of India’s (SBI) server was left without any password protection exposing the contact details, balances and partial account number details of its users. </li><li>The server has since been secured, but while left vulnerable, it had archived messages going back to December. </li><li>While no sensitive data was disclosed, the data breach leaves customers susceptible to social engineering hacks and extortion.</li></ul>Hacking is where someone has to bypass security in order to get information, but India’s largest bank, the State Bank of India (SBI), left the data of millions of users exposed all because it <a href="https://techcrunch.com/2019/01/30/state-bank-india-data-leak/">did not set a password</a> on its server. The ‘SBI Quick’ server — a service that allows the bank’s customers to text the bank for information on their accounts — has reportedly been secured since the report. But while it was open, it had archives of messages dating back to December according to TechCrunch’s investigation. That’s millions and millions of messages about balance information, loan inquiries, financial transactions and other data — although there were no passwords disclosed. The data breach was spotted by a security researcher (unnamed) and verified by Karan Saini, the researcher who previously found a leak in India’s Aadhaar database, the largest biometric authentication system in the world. Business Insider has reached out to SBI but they are yet to issue a response on the data breach. . Your data is secure… so far While there was no sensitive data on the server, simple details like partial account numbers and contact information can render the SBI customers vulnerable to ransom demands. Social engineering attacks, one of the most common ways commit financial fraud, could also be a possibility. Drawing a correlation between a phone number and a high account balance, a social engineering attack would involve human interaction and manipulating their targets in to breaking normal security guidelines. 
 
 <div type="ExtQuote" text="“The data available could potentially be used to profile and target individuals that are known to have high account balances.&quot;" auname="Karan Saini, security researcher told TechCrunch"></div>





 The scope of the problem As India’s largest bank, SBI claims to have more than 500 million customers worldwide with 740 million accounts. And since the bank hasn’t issued any response there isn’t any data available to determine exactly which customers’ data was exposed and how many customers are vulnerable overall. But, in a single data, the server shoots out nearly three million messages which doesn’t paint a very encouraging picture. India’s problem with data Protecting data is a much larger program and goes beyond SBI. It’s not companies aren’t spending on security, but it’s getting harder to stay ahead of the challenges. To be fair, in SBI’s case, it was a simple case of negligence. When the Cosmos Bank — a 112 year old bank in India — was <a href="https://economictimes.indiatimes.com/industry/banking/finance/banking/north-korean-connection-to-cosmos-hacking-signs-point-to-bangladesh-heist-masterminds/articleshow/65411640.cms">hacked</a> in August last year, it was the victim of an attack carried out by the Lazarus Group of North Korea. A report by the Boston Consulting Group (BCG) <a href="https://www.bcg.com/en-in/capabilities/technology-digital/mastering-cybersecurity.aspx">found</a> that among 50 of the recent major data breaches, only 28% were caused by inadequate security tech. In all the other cases — that’s 72% or nearly three-quarters — the breaches were caused due to organizational failure, process failure or, simply, employee negligence. While improving the technology behind cybersecurity is important, it’s also key to drive resilience measures in order to improve efficacy. See also: <a href="https://www.businessinsider.in/nearly-773-million-email-accounts-have-been-exposed-in-a-massive-data-breach-heres-how-to-check-if-you-were-affected/articleshow/67576032.cms">Nearly 773 million email accounts have been exposed in a massive data breach. Here's how to check if you were affected</a> <a href="https://www.businessinsider.in/state-bank-of-india-halves-withdrawal-limit-at-atms-to-20000-per-day-to-prevent-fraud/articleshow/66442390.cms">State Bank of India halves withdrawal limit at ATMs to ₹20,000 per day to prevent fraud</a> <a href="https://www.businessinsider.in/the-21-biggest-data-breaches-of-2018/articleshow/67045497.cms">The 21 biggest data breaches of 2018</a>

India’s largest bank leaves the data of millions of users exposed

<ul><li>A new survey finds that 80% of Indians don’t trust the <keyword id="144117" type="ORGANIZATION" weightage="20" keywordseo="AADHAAR">Aadhaar</keyword> card program.</li><li>Respondents agree that the government needs to take <keyword id="187124" type="ORGANIZATION" weightage="20" keywordseo="Data-Protection">data protection</keyword> more seriously. </li><li>The government had previously signed an affidavit for the Supreme Court, stating that the Aadhaar database can neither be hacked nor breached.</li></ul>The Aadhaar card scheme, a 12-digit unique identity number for residents in India, has been embroiled in controversy since its initiation in 2009. Nine years down the line, citizens still don’t <a href="https://cio.economictimes.indiatimes.com/news/digital-security/80-people-concerned-about-aadhaar-data-security-study/64383641">trust</a> the world’s <a href="https://telecom.economictimes.indiatimes.com/news/aadhaar-worlds-largest-id-database-exposed-by-india-government-errors/64175448">largest</a> biometric ID system. A survey conducted by Velocity MR, a market research and analysis company, concluded that eight out of 10 respondents were concerned about the security of their Aadhar data and felt the government should be more proactive about data protection. This comes from taking 5,800 respondents into consideration, across 8 tier-1 cities in India, including the National Capital Region. The Aadhaar conundrum Headlines that call the security of Aadhaar into the question rear their head every few months. Regardless of whether it’s a <a href="https://www.indiatimes.com/technology/news/an-online-researcher-hacked-into-aadhaar-s-official-android-app-to-show-how-poorly-it-s-secured-337425.html">French researcher</a> or <a href="https://economictimes.indiatimes.com/tech/internet/uidai-trashes-zdnet-report-refutes-aadhaar-data-leak-claim-by-delhi-researcher/articleshow/63446024.cms">ZDNet</a>, the issue lies with the government’s reiterations of the Aadhaar system being ‘<a href="https://www.troyhunt.com/is-indias-aadhaar-system-really-hack-proof-assessing-a-publicly-observable-security-posture/">hack-proof</a>’. The Unique Identification Authority of India (<keyword id="6355252" type="DEFINITION" weightage="20" keywordseo="uidai">UIDAI</keyword>), the government agency behind Aadhaar cards has <a href="https://economictimes.indiatimes.com/news/politics-and-nation/aadhaar-data-is-fully-safe-uidai/articleshow/61725239.cms">said</a>, “The Aadhaar data, including biometric information, is fully safe and secure.” Even the government filed an <a href="https://www.firstpost.com/india/government-files-affidavit-in-aadhaar-case-claims-it-cannot-be-hacked-or-breached-supreme-court-to-hear-case-today-4190835.html">affidavit</a> with the Supreme Court in lieu of the Aadhaar case, that claimed that the data collected through the system cannot be breached or hacked. Security in itself is not a zero-sum game. Technology evolves at such velocity that safeguards becoming obsolete is always a concern, while also being inevitable. That being said, a system cannot be completely secure, it can only be sufficiently prepared. The Cambridge Analytica data breach scandal goes a long way in proving the same. It’s one of reasons why the conversation has veered from obtaining consent to getting ‘<a href="https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/consent/what-is-valid-consent/">valid’ </a>consent. The same survey, when asking about Facebook usage, found that 1-in-3 users are going to reduce the amount of information they share on the social networking platform, though they aren’t ready to leave it altogether. Because, let’s be honest, there’s always a weak link or a point of vulnerability. The question is, how long will it be before someone finds it.

Nine years later, 80% of Indians are still not convinced the world’s largest biometric ID system is secure

Like a lot of botched situations, this one started with an ill-advised tweet. On 28 July, Ram Sewak Sharma, the current chief of the Telecom Regulatory Authority of India (TRAI) and interestingly, the former chief of the Unique Identification Authority of India (<keyword id="6355252" type="DEFINITION" weightage="20" keywordseo="uidai">UIDAI</keyword>), challenged the Indian public to do their worst after disclosing his <keyword id="155319" type="COMPANY" weightage="20" keywordseo="Aadhar">Aadhar</keyword> number on <keyword id="6354616" type="UNKNOWN" weightage="20" keywordseo="Twitter">Twitter</keyword>. 
 
 
 
 <div type="javascript" title="Custom"><cdata><![CDATA[
 
]]></cdata></div>









 The challenge was meant to end the <keyword id="6355135" type="UNKNOWN" weightage="20" keywordseo="Privacy">privacy</keyword> debate over Aadhar once and for all. Here was a prominent government official and a staunch advocate of the Aadhar programme giving out his details and asking for a “concrete example of harm”. The Twitterati had a field day. A number of users posted details about his PAN card, mobile number, home address and date of birth. However, Sharma brushed off the responses, stating that the info found was publicly available and they had nothing to do with his Aadhar number. While the accuracy of most of the information found wasn’t able to be verified, the damage was done. 
 
 
 
 <div type="javascript" title="Custom"><cdata><![CDATA[
 
]]></cdata></div>
 
 
 
 
 <div type="javascript" title="Custom"><cdata><![CDATA[
 
]]></cdata></div>









 Even a French hacker, going by the handle of Elliot Alderson, like the character in the TV show Mr. Robot, weighed into the debate, posting a picture of Sharma with his daughter and declaring that he should never have disclosed his number in the first place. 
 
 
 
 <div type="javascript" title="Custom"><cdata><![CDATA[
 
]]></cdata></div>









 Sharma, however, remained adamant. He said that no “harm” had been caused yet, implying that he believed that he had won the challenge. 
 
 
 <div type="javascript" title="Custom"><cdata><![CDATA[
 
]]></cdata></div>
 On 29 July, the UIDAI released a statement on the issue. The government agency in charge of implementing the Aadhar programme refuted the fact that RS Sharma’s personal information had been stolen by using his Aadhar number and reiterated the fact that these details were already available on the internet. 
 
 
 <div type="javascript" title="Custom"><cdata><![CDATA[
 
]]></cdata></div>







 On 30 July, the Indian government issued a statement saying that Sharma’s personal details hadn’t been extracted from the Aadhar database, and therefore, had nothing to do with the security of the Aadhar programme. 
 
 
 <div type="javascript" title="Custom"><cdata><![CDATA[
 
]]></cdata></div>







 On 31 July, Sharma, looking to reframe the narrative, authored <a href="https://indianexpress.com/article/opinion/columns/rs-sharma-aadhaar-number-challenge-trai-chairman-twitter-5283781/">an opinion piece </a>in the Indian Express titled “Why I gave out my Aadhar number”. He explained that the tweet wasn’t “impulsive” and restated his beliefs about the security of the system. Rather than explaining what the risks of the programme were and how the UIDAI had provisioned for these risks, Sharma chastised the critics of Aadhar for “scaremongering”. He added that the people who had taken up the challenge had found his personal details through Google searches and had been using the info to “unsuccessfully” hack his email account and also subscribe him to a number of services, which failed because they required OTP authentication. Finally, he addressed the fact that someone had deposited ₹1 into his account. Without pausing to examine the leak of the his bank account info, he said that this did not mean anything because he had actually received money, which was a good thing. However, on the same day, the UIDAI issued a series of tweets cautioning people against giving out their Aadhar details. 
 
 
 <div type="javascript" title="Custom"><cdata><![CDATA[
 
]]></cdata></div>







 The statement, which functioned as a veiled rebuke of the challenge in the first place, explained that publishing personal information was not compliant with the law. The UIDAI also said that it was doing so would make the holder “vulnerable”, although it wasn’t clear to what - trolling on social media or the theft of their private info? The end result? No one knows for sure whether the Aadhar programme is safe or not. No one’s mind seems to have changed. If anything is certain, however, it is that the people at the helm of the programme need to think first before starting a wave of misinformation and confusion on social media. It only serves to dilute the national conversation.

Here’s what you need to know about TRAI chief’s Aadhar challenge and everything that’s happened since

<a href="http://www.businessinsider.in/searchresult.cms?query=cyber+extortion">Cyber extortion</a> is giving many companies sleepless nights, especially in Hyderabad. A slew of cases have been reported from the city where hackers have withheld company’s websites and asked for payment in <a href="http://www.businessinsider.in/searchresult.cms?query=bitcoins">Bitcoins</a> in return. 
 
The <a href="http://www.businessinsider.in/searchresult.cms?query=hackers">hackers</a> penetrate the weak security systems of several companies and threaten individuals of putting up <a href="http://www.businessinsider.in/searchresult.cms?query=confidential+information">confidential information</a> on websites or even sell them. 
 
The information sold can range from email IDs to Aadhaar and bank account numbers. 
 
“An incident of data being kept hostage was first reported a year ago. At that time, we did not take it seriously. But when another victim came with a similar complaint in late July, we realised that it's a new modus operandi," assistant commissioner of police (Cyber Crimes) B Anuradha told TOI. 
 
Cyber experts say data sharing is invaluable for improving businesses and hackers take advantage of it and sell important information sale for a few lakhs of rupees. 
 
The news daily reported that one of the most common <a href="http://www.businessinsider.in/searchresult.cms?query=cyber+frauds">frauds</a> being committed by hackers is to misguide business partners by sending emails from similar looking email ids and asking them to transfer money to new accounts. 
 
"Corporates and individuals should always maintain upgraded operating systems, firewalls and advanced anti-virus softwares to protect data from intrusion. One should avoid using unlicensed, pirated, free anti-virus tools available on the web, since many of them are not foolproof. Corporates should have a periodic cyber audit to avoid data <keyword id="6357115" type="UNKNOWN" weightage="20" keywordseo="hacking">hacking</keyword>. Never open unsolicited mails or invites on social media," joint commissioner of police (CCS), T Prabhakar Rao, told TOI. 
 
He also suggested that users should always have passwords that are complicated and not predictable like names of family members. 
 
So, one needs to be careful and not give in to cyber hackers. To begin with, one should never open or respond to unsolicited emails or invites on social media. People should not download free mobile apps that offer free talk time. One is also advised to have complicated passwords. 
 
(Image: Thinkstock)

Beware companies! Plug in all loopholes as cyber extortion is on the rise

<ul><li>The Indian government’s new rules for social media platforms like <keyword id="6354576" type="UNKNOWN" weightage="20" keywordseo="facebook">Facebook</keyword> and Twitter mandates the ‘voluntary’ verification of users.</li><li>According to <keyword id="6355041" type="ORGANIZATION" weightage="20" keywordseo="mozilla">Mozilla</keyword>, this could potentially put personal data at greater risk of being hacked.</li><li>Doosra, an Hyderabad-based startup, is offering a way, for users worried about their privacy, to create an alternative digital identity.</li></ul>Facebook, <keyword id="790242" type="COMPANY" weightage="20" keywordseo="WhatsApp">WhatsApp</keyword>, Twitter and other social media platforms have been asked to <a href="https://www.businessinsider.in/tech/enterprise/news/mozilla-is-not-happy-with-indias-new-it-rules-claiming-there-arent-enough-checks-and-balances-in-place/articleshow/81308608.cms">verify the identity of their users</a> — this could be either through phone numbers or government-issued IDs like the Aadhaar card. Putting your number online is not just a risk in the face of <a href="https://www.businessinsider.in/news/a-scary-proposal-to-use-facial-recognition-and-ai-by-an-indian-state-has-experts-fuming/articleshow/80421935.cmshttps://www.businessinsider.in/news/a-scary-proposal-to-use-facial-recognition-and-ai-by-an-indian-state-has-experts-fuming/articleshow/80421935.cms">increasing government surveillance</a>. It is also about privacy and online safety since personal data can have in-real-life (IRL) consequences like being targeted by stalkers, trolls or people looking to hack into your bank account. “Where there is personal data, there is a great risk of hackers trying to steal it,” pointed out <a href="https://www.businessinsider.in/tech/enterprise/news/mozilla-is-not-happy-with-indias-new-it-rules-claiming-there-arent-enough-checks-and-balances-in-place/articleshow/81308608.cms">Mozilla</a> in a statement. An Indian startup based in Hyderabad called <a href="https://www.doosra.com/about-us">Doosra</a> has a possible solution. Instead of using your real number to sign up, use an alternative number to create a secondary digital identity. This doesn’t mean going out to buy a new SIM, but creating a second app-based ‘virtual’ number. “The only people that will have any kind of access to your primary number would be if we got an executive order from the official authorities,” <a href="https://www.linkedin.com/in/adityavuchi/?originalSubdomain=in">Aditya Vuchi</a>, founder and chief executive of Doosra told Business Insider. This means that if your social media handle is found to be a part of any activity, which violates Section 69 of the IT Act, the government or Supreme Court will first have to issue an order to the social media platform. If and once they discover that the mobile number given is a Doosra number, they will have to issue another order to Doosra in order to gain access to your primary number. The trouble with mobile numbers Mobile phone numbers started out as a simple communication tool. Their purpose was simply to allow your friends and loved ones to reach you no matter where you were. Over time, mobile phone numbers turned identifiers for business databases — a way for them to keep track of their customers — before turning into an all out marketing tool. The Indian government’s mandate to use phone numbers as a way of <a href="https://www.businessinsider.in/policy/news/indias-new-rules-for-facebook-whatsapp-and-other-social-media-platforms-explained-in-five-points/articleshow/81285658.cms">‘voluntary’ verification</a> — a know-your-customer process, of sorts — for accessing these online platforms poses a new threat. “This means that any message you share on WhatsApp, Facebook and other platforms that is re-shared, makes your number that much more accessible to various databases, leading to spam from real estate offers, insurance scams, stalkers and worse,” said Vuchi. Addressing the deficit of trust The six-month old Doosra is the first such service to be available in India. It is not that other such apps don’t exist — like 2ndLine, Hushed, and Burner — but you need an American or Canadian number in order to sign up for them. Doosra caters to numbers based out of India. You need your real number to sign up for the service, and it is not free with plans starting at ₹59 per month for essential services and ₹83 per month for the pro package. The Doosra number can be used to sign up for <a href="https://www.businessinsider.in/tech/apps/news/whatsapp-signal-and-telegram-face-a-catch-22-situation-as-indias-new-social-media-rules-threaten-encryption/articleshow/81221070.cms">WhatsApp</a>, Twitter and others or given for Aadhaar, banking details and subscriptions. This is because all of these services require an OTP for verification and Doosra logs all the incoming messages on your <keyword id="10867302" type="UNKNOWN" weightage="20" keywordseo="secondary-number">secondary number</keyword>. “I bought a car very recently. And, throughout the entire cycle, neither the sales guy or the paperwork guy has access to my primary number. They only had access to my Doosra number,” said Vuchi. According to him, most people using the app so far are addressing a ‘deficit of trust’. They’re uncertain of how their number will be used — or misused — if they give it out to a third party, which is not surprising considering that when you go online to shop for insurance, at a portal like PolicyBazaar, they want you to share your number before you can even compare rates and figure out what you want. The startup did not share the exact number of subscribers it has so far, but Vuchi did disclose that Doosra has seen just shy of a million messages and around 25,000 business sender IDs have been detected. “We can’t see what the messages are, but we do know when businesses reach out to the consumers” he explained. The key clientele so far has been small business owners, sales professionals, and, in some cases, actors too. But with the walls closing in around a person’s digital identity and privacy turning into a luxury that very few can afford — Doosra expects business to boom in the future. SEE ALSO: <a href="https://www.businessinsider.in/business/startups/news/razorpay-set-to-buyback-esops-worth-10-million-investors-sequoia-and-gic-will-be-the-buyers/articleshow/81324622.cms">Razorpay set to buyback ESOPs worth $10 million – investors Sequoia and GIC will be the buyers</a> <a href="https://www.businessinsider.in/tech/enterprise/news/mozilla-is-not-happy-with-indias-new-it-rules-claiming-there-arent-enough-checks-and-balances-in-place/articleshow/81308608.cms">Mozilla is not happy with India's new IT rules claiming there aren't enough checks and balances in place</a> <a href="https://www.businessinsider.in/business/news/indian-companies-stand-to-lose-7-14-lakh-crore-to-climate-change-but-they-could-end-up-making-2-9-lakh-crore-too/articleshow/81306789.cms">Indian companies stand to lose ₹7.14 lakh crore to climate change — but they could end up making ₹2.9 lakh crore too</a>

You Searched For "aadhaar hacked" and got 11 results

Covid-19 vaccination data reportedly leaked – ID proof, date of birth and other details available on Telegram

Sourabh Jain

CSC BHIM site left Aadhaar cards, PAN numbers, and biometric information exposed — could be used to carry out financial fraud and identity theft, says report

Rounak

Prabhjote

Discount broker Upstox suffers data breach – Aadhaar, PAN and bank account numbers leaked

Rounak Jain

Here are the most controversial data breaches of 2018 that affected Indian users

Can Nilekani, the architect of the world’s largest biometric project, spark digital payments in India?

Prabhjote Gill

Indian government portal leaks 8.9mn Aadhaar details, again

Prabhjote Gill

India’s largest bank leaves the data of millions of users exposed

Prabhjote Gill

Nine years later, 80% of Indians are still not convinced the world’s largest biometric ID system is secure

Prabhjote Gill

Here’s what you need to know about TRAI chief’s Aadhar challenge and everything that’s happened since

Dilsher Dhillon

Beware companies! Plug in all loopholes as cyber extortion is on the rise

BI India Bureau

This spam blocker may add a layer of anonymity to your social media presence while Twitter and Facebook are under pressure to verify their users

Prabhjote Gill

Popular Keywords

Buying Guides