Best printers for Home

Best Mixer Grinder

Best wired Earphones

Best 43 Inch TV in India

Best Wi Fi Routers

Best Home Theatre in India

Smart Watch under 5000

Best Laptops for Education

Best Laptop for Students

<ul><li>The CSC <keyword id="9325628" type="UNKNOWN" weightage="20" keywordseo="BHIM-data-breach">BHIM data breach</keyword> includes extremely sensitive information like Aadhaar details with complete scans of the Aadhaar cards, biometric details, addresses, date of birth and more.</li><li>In total, over 7 million records of millions users were exposed.</li><li>CERT-In, which was notified of the leak on May 5, had reportedly fixed it on May 22.</li></ul>Over 7 million records of user transactions on the CSC BHIM website were left unsecured as per a report Israeli cybersecurity website vpnMentor. These records include Aadhaar card numbers, PAN numbers, and even biometric details in a data bundle of 409 GB. According to the <a href="https://www.vpnmentor.com/blog/report-csc-bhim-leak/">report</a>, the CSC BHIM data breach includes personal data such as Aadhaar details, addresses, bank records, caste certificate and a complete personal profile of the users. <div type="Article" hostid="261" msid="63924186" title="Indian government portal leaks 8.9mn Aadhaar details, again" mstype="2" mssubtype="0"></div> The data breach has since been patched up but the data was out there for anyone who knew where to look for over a year. However, the National Payments Corporation of India denies that there has been any incident. “We would like to clarify that there has been no data compromise at <keyword id="4013165" type="PERSON" weightage="20" keywordseo="BHIM-app">BHIM App</keyword> and request everyone to not fall prey to such speculations. NPCI follows high level of security and an integrated approach to protect its infrastructure and continue to provide a robust payments ecosystem,” it said. How bad is the BHIM data breach? The cybersecurity researchers believe that the combination of data left exposed could give hackers the ability to carry out identity theft, tax fraud, monetary theft, among other illegal activities. The research team led by Noam Rotem and Ran Locar describe the data breach as being akin to a hacker gaining access to the entire data infrastructure of a bank and detailed information about its users’ account information. “The sheer volume of sensitive, private data exposed, along with UPI IDs, document scans, and more, makes this breach deeply concerning,” said the report explaining the seriousness of the data breach. They assert that using the above details of the personal data about an individual, from their names and dates of birth to biometric details and ID numbers, could give third-party onlookers a complete profile of an individual — including a look into their finances and banking records. “It would be incredibly valuable to hackers… This data would make illegally accessing those accounts much easier,” said the report. With complete profiles of BHIM users being leaked, it leaves them extremely vulnerable to all sorts of frauds and theft. The risks for affected users can exceed just monetary loss – there is a high risk of identity theft, especially since almost all personal data has been exposed. “The scale of the exposed data is extraordinary, affecting millions of people all over India and exposing them to potentially devastating fraud, theft, and attack from hackers and cybercriminals,” it added, suggesting that the breach is likely very invasive. How and when was BHIM UPI’s data breached? The cybersecurity researchers claim that 409 GB of data was stored on an unsecured Amazon Web Services (AWS) S3 bucket exposing records from February 2019. “S3 buckets are a popular form of cloud storage across the world but require developers to set up the security protocols on their accounts,” said the report. The research team at vpnMentor discovered the BHIM data breach on April 23 and contacted India’s Computer Emergency Response Team (CERT-In) on May 5. The data leak was finally fixed by the authorities on May 22, leaving the breach exposed for an entire month after it was discovered. <table style="border-width: initial; border-style: none; width: 451.276pt; table-layout: fixed;"></colgroup><tbody><tr><td colspan="2" style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;">Timeline of the data breach </td></tr><tr><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;">Date discovered </td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;">April 23, 2020 </td></tr><tr><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;">Contact with CERT-In </td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;">April 28, 2020 </td></tr><tr><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;">Response from CERT-In </td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;">April 29, 2020 </td></tr><tr><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;">Contact with company </td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;">May 5, 2020 </td></tr><tr><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;">Second contact with CERT-In </td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;">May 22, 2020 </td></tr><tr><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;">Data of rectification </td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:top;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;">May 22, 2020* </td></tr></tbody></table> *Assumed day of rectification after no reply from CERT-In Source: VPNMentor What can you do? Unfortunately, there’s not much you can do on your end right now. If you are unsure about your data safety, you can contact CSC e-Governance Services, which is a special division set up under the Ministry of Electronics &amp; IT. The NPCI maintains that their systems are robust and no data breach occurred to begin with despite evidence posted by the vpnMentor's cybersecurity team. SEE ALSO: <a href="https://www.businessinsider.in/indian-government-portal-leaks-8-9mn-aadhaar-details-again/articleshow/63924186.cms">Indian government portal leaks 8.9mn Aadhaar details, again</a> <a href="https://www.businessinsider.in/slideshows/here-are-the-most-controversial-data-breaches-of-2018-that-affected-indian-users/slidelist/67155541.cms">Here are the most controversial data breaches of 2018 that affected Indian users</a> <a href="https://www.businessinsider.com/r-new-data-leak-hits-indias-national-id-card-database-aadhaar-zdnet-2018-3?IR=T">New data leak hits India's national ID card database Aadhaar: ZDNet</a>

CSC BHIM site left Aadhaar cards, PAN numbers, and biometric information exposed — could be used to carry out financial fraud and identity theft, says report

The <keyword id="394949" type="CITY" weightage="20" keywordseo="National-Payments-Corporation">National Payments Corporation</keyword> of India (<keyword id="193629" type="COMPANY" weightage="20" keywordseo="NPCI">NPCI</keyword>) on Tuesday said that there has been no data compromise pertaining to the <keyword id="4013165" type="PERSON" weightage="20" keywordseo="BHIM-app">BHIM App</keyword> and has requested everyone not to fall prey to such incorrect information. In a statement, the NPCI said that it has conducted an independent verification of the recent news, including through a leading Digital Risk Monitoring firm who has reconfirmed that the claims against the BHIM App are untrue. "There is no data leak with respect to the BHIM app," it said. The statement comes a day after a <a href="https://www.vpnmentor.com/blog/report-csc-bhim-leak/" data-type="tilCustomLink">report</a> said that security researchers have discovered that about 7.26 million records linked to users of mobile payments app BHIM were left exposed to the public by a website. <div type="Article" hostid="261" msid="76135419" title="CSC BHIM site left Aadhaar cards, PAN numbers, and biometric information exposed — could be used to carry out financial fraud and identity theft, says report" mstype="2" mssubtype="0"></div> The exposed data included sensitive information such as names, dates of birth, age, gender, home address, caste status and Aadhaar card details, among others, said the report from VPN review website vpnMentor. NPCI said <keyword id="4115852" type="COMPANY" weightage="20" keywordseo="CSC-e-Governance-Services-India-Ltd">CSC e-Governance Services India Ltd</keyword> was working in 2018 on a project to educate and activate village level entrepreneurs on digital payments and also educating them to create Merchant Virtual Payment Address (VPA). Most of these VPAs were not valid UPI IDs. Moreover, it said that <keyword id="4003296" type="COMPANY" weightage="20" keywordseo="UPI-ID">UPI ID</keyword> is a virtual ID that is meant to be shared conveniently, instead of real account details. The UPI ID can be used to receive money. The user can simply share his UPI ID with the payer and receive payment directly in his bank account. This is a standard feature used by merchants, who only need to receive money using UPI, it said. Based on the findings from the Digital Risk Monitoring firm, it is ascertained that there is not a single instance of data breach compromising financial details of the customers, the NPCI statement said.

NPCI denies data breach of BHIM mobile app

New Delhi, June 1 (IANS) Security researchers have discovered that about 7.26 million records linked to users of mobile payments app BHIM were left exposed to the public by a website. The exposed data included sensitive information such as names, dates of birth, age, gender, home address, caste status and Aadhaar card details, among others, said the report from VPN review website vpnMentor. "The scale of the exposed data is extraordinary, affecting millions of people all over India and exposing them to potentially devastating fraud, theft, and attack from hackers and cybercriminals," the security researchers from vpnMentor wrote in a blog post on Sunday. Offered by the National Payments Corporation of India (NPCI), the app BHIM, or Bharat Interface for Money, was launched in 2016. In a statement on Monday, the NPCI said that "there has been no data compromise at BHIM App." "We have come across some news reports which suggest data breach at BHIM App. We would like to clarify that there has been no data compromise at BHIM App and request everyone to not fall prey to such speculations. NPCI follows high level of security and an integrated approach to protect its infrastructure and continue to provide a robust payments ecosystem," said the NPCI. In its report, vpnMentor also said that the website that leaked the data was developed by a company called CSC e-Governance Services LTD. in partnership with the Indian government. The issue was resolved late last month after the researchers contacted India's Computer Emergency Response Team (CERT-In) twice in a month's time. "In this case, the data was stored on an unsecured Amazon Web Services (AWS) S3 bucket," the researchers said, adding that S3 buckets are a popular form of Cloud storage across the world but require developers to set up the security protocols on their accounts. "We reached out to the website's developers to notify them of the misconfiguration in their S3 bucket and to offer our assistance. After not receiving a reply, we contacted India's Computer Emergency Response Team (CERT-In), which deals with cybersecurity in the country," they added. It appears CSC established the website connected to the misconfigured S3 bucket to promote BHIM usage across India and sign up new merchant businesses, such as mechanics, farmers, service providers, and store owners onto the app, according to the research led by vpnMentor's Noam Rotem and Ran Locar. The volume of exposed data which was first discovered by the security researchers on April 23 amounted to 409GB. "It's difficult to say precisely, but the S3 bucket seemed to contain records from a short period: February 2019. However, even within such a short timeframe, over 7 million records had been uploaded and exposed," said the report. "The exposure of BHIM user data is akin to a hacker gaining access to the entire data infrastructure of a bank, along with millions of its users' account information," it added. --IANS gb/na

7.26 million records of BHIM user data leaked: Report

New Delhi, June 1 (IANS) Security researchers have discovered that about 7.26 million records linked to users of mobile payments app BHIM were left exposed to the public by a website. The exposed data included sensitive information such as names, dates of birth, age, gender, home address, caste status and Aadhaar card details, among others, said the report from VPN review website vpnMentor. "The scale of the exposed data is extraordinary, affecting millions of people all over India and exposing them to potentially devastating fraud, theft, and attack from hackers and cybercriminals," the security researchers from vpnMentor wrote in a blog post on Sunday. The breach was closed late last month after the researchers contacted India's Computer Emergency Response Team (CERT-In) twice in a month's time. The BHIM website in question was developed by a company called CSC e-Governance Services LTD. in partnership with the Indian government. "In this case, the data was stored on an unsecured Amazon Web Services (AWS) S3 bucket," the researchers said, adding that S3 buckets are a popular form of Cloud storage across the world but require developers to set up the security protocols on their accounts. "We reached out to the website's developers to notify them of the misconfiguration in their S3 bucket and to offer our assistance. After not receiving a reply, we contacted India's Computer Emergency Response Team (CERT-In), which deals with cybersecurity in the country," they added. It appears CSC established the website connected to the misconfigured S3 bucket to promote BHIM usage across India and sign up new merchant businesses, such as mechanics, farmers, service providers, and store owners onto the app, according to the research led by vpnMentor's Noam Rotem and Ran Locar. The volume of exposed data which was first discovered by the security researchers on April 23 amounted to 409GB. "It's difficult to say precisely, but the S3 bucket seemed to contain records from a short period: February 2019. However, even within such a short timeframe, over 7 million records had been uploaded and exposed," said the report. "The exposure of BHIM user data is akin to a hacker gaining access to the entire data infrastructure of a bank, along with millions of its users' account information," it added. Offered by the National Payments Corporation of India (NPCI), the app BHIM, or Bharat Interface for Money, was launched in 2016. --IANS gb/na

You Searched For "bhim sensitive data" and got 4 results

CSC BHIM site left Aadhaar cards, PAN numbers, and biometric information exposed — could be used to carry out financial fraud and identity theft, says report

Rounak

Prabhjote

NPCI denies data breach of BHIM mobile app

IANS

7.26 million records of BHIM user data leaked: Report

IANS

7.26 million records of BHIM users data leaked: Report

IANS

Popular Keywords

Buying Guides