750 Million Indian Mobile Users Data Allegedly Leaked, DoT Orders Security Audit

In response to recent claims made by cybersecurity firm CloudSEK regarding a massive data leak affecting 750 million Indian mobile subscribers, the Department of Telecom (DoT) has taken swift action by instructing service operators to undergo a thorough security audit of their systems. The alleged leak, involving a 1.8 terabyte database containing sensitive personal information, has raised serious concerns about cybersecurity and data protection in the country.

Representative image

CloudSEK's Discovery and Hacker's Response

CloudSEK's researchers uncovered the alarming revelation that hackers were attempting to sell the extensive database on the dark web. However, the hacker responsible for the leak has denied any involvement in a breach, asserting that the data was obtained through undisclosed asset work within law enforcement channels. Despite this denial, the situation demands immediate attention and comprehensive security measures to safeguard the privacy of Indian citizens.

DoT's Response and Telecom Operators' Assessment

In light of the alleged data leak, the DoT has promptly directed telecom operators to conduct a security audit of their systems. However, preliminary assessments shared informally by the operators suggest that the leaked information may be a compilation of older data sets rather than a result of any vulnerability in their systems. Further investigation is underway to ascertain the veracity of these claims and determine the source of the leak.

Details of the Leaked Data and Potential Risks

CloudSEK's report revealed that the leaked database contains critical information belonging to approximately 750 million individuals. This sensitive data includes names, mobile numbers, addresses, and even Aadhaar details. The sheer volume of the dataset, amounting to 1.8 terabytes, poses a significant threat to both individuals and organizations, making them vulnerable to a wide range of cyberattacks and identity theft.

Responsible Disclosure and Notification to Authorities

CloudSEK, a cyber intelligence firm that collaborates with the government's cybersecurity agency CERT-In, promptly disclosed the data breach on January 23. As part of responsible disclosure, the firm notified relevant authorities and organizations potentially affected by the leak. The data, available for sale, is compressed to 600GB and uncompressed to 1.8TB, further amplifying the potential risks associated with this incident.

Financial and Reputational Risks

The leak of Personally Identifiable Information (PII) poses substantial risks to individuals and organizations alike. Financial losses, identity theft, reputational damage, and increased susceptibility to cyberattacks are just a few of the potential consequences. The magnitude of this data leak demands immediate validation of the data and identification of the security loophole responsible for the breach.

The alleged data leak of 750 million Indian subscribers has sent shockwaves through the nation, highlighting the urgent need for robust cybersecurity measures. The DoT's prompt response in ordering a security audit of telecom operators' systems is a crucial step towards addressing the situation. However, further investigation is necessary to determine the authenticity of the leaked data and implement appropriate measures to safeguard the privacy and security of Indian citizens.