India's Biggest-Ever Data Breach? Personal Details of 81.5 Crore People Leaked

In what is being billed as possibly the 'biggest' data leak in the country, personally identifiable information of 815 million (81.5 crore) Indians have been up on the dark web for sale, according to a report by US-based cybersecurity firm Resecurity.

Information including Aadhaar and passport details, alongside names, phone numbers, and addresses, is reportedly being sold online. Media reports indicate a potential compromise of the Indian Council of Medical Research (ICMR) database due to the broad range and sensitivity of the information involved.

An individual, calling himself a 'threat actor' using the alias 'pwn001', posted a thread on Breach Forums.

An individual, calling himself 'threat actor', on 'X' has advertised a database in a breached dark web forum. This database reportedly contains records of 81.5 million Indian citizens, encompassing Aadhaar and passport information, alongside names, phone numbers, and addresses. The 'threat actor' alleges that the data, obtained from COVID-19 test details of citizens, was sourced from ICMR, according to a News18 report.

Resecurity, an American agency specializing in cybersecurity and intelligence was first to notice the leak, the report said.

According to the cybersecurity firm, an individual identified as a 'threat actor' using the alias 'pwn001' started a thread on Breach Forums. This forum, self-described as a 'premier Databreach discussion and leaks forum', facilitated access to records of 815 million Indian citizens.

'pwn001' has shared spreadsheets containing four significant leak samples with portions of Aadhaar data. Upon analysis, these were confirmed as valid Aadhaar card IDs, the report added.

ICMR has encountered numerous cyber-attack attempts since February, and both central agencies and the council were aware of these data breach attempts. Last year, there were over 6,000 attempts to breach ICMR servers.
In August, another 'threat actor' identified as 'Lucius' posted a discussion on BreachForums, proposing to vend a 1.8 terabyte data breach associated with an unspecified "Indian internal law enforcement organization."