Aadhaar Data Security Alert: Private Data Of 81 Crore Indians Under Security Threat; Is Your Aadhaar Safe?

Aadhaar Alert: A report by US-based cybersecurity company Resecurity has said that personal identifiable information of around 815 million or 81.5 crore Indians has been leaked and is up for sale on the dark web, according to a Business Standard report.

As per the report, personal details including Aadhaar and passport information along with names, phone numbers, and addresses are available for sale online.

Media reports indicated that the Indian Council of Medical Research (ICMR) database might have been compromised, in view of the extensive scope and sensitive nature of the information. A response from ICMR regarding the issue is still awaited. Aadhaar is a 12-digit individual identification number issued by the Unique Identification Authority of India on behalf of the Government of India.

In a blog post dated October 15, 2023, the Resecurity website wrote, "On October 9th, a threat actor going by the alias 'pwn0001' posted a thread on Breach Forums brokering access to 815 million "Indian Citizen Aadhaar & Passport" records. To put this victim group in perspective, India's entire population is just over 1.486 billion people."
The company said that its HUNTER investigators established contact with the threat actor and learned they were willing to sell the entire Aadhaar and Indian passport dataset for $80,000.

The data set offered by pwn0001 contains multiple fields related to the PII of Indian citizens, including but not limited to Fields, name, father name, number, other number, passport number, aadhar number, age, gender, address, district, pin code, and state.

According to media reports, the Central Bureau of Investigation (CBI) is currently investigating the breach that was discovered by hacker "pwn0001."

Since its inception in 2009, UIDAI has issued nearly 1.4 billion Aadhaar cards.

One should note that, In August this year, another threat actor known as "Lucius" posted a thread on BreachForums offering to sell a 1.8 terabyte data leak related to an unnamed "Indian internal law enforcement organisation".