Data Breach India News: On Monday, an international cybersecurity firm, CloudSEK, claimed a large-scale data breach of 750 million Indian mobile users. The firm in its disclosure said that its researchers have found that hackers are selling over 1.8 TB of data of Indians, including their names, mobile numbers, addresses, and Aadhaar details. The firm further said that this data is out on sale on the dark web, an underground internet marketplace.
Following the news of the data breach, the Department of Telecom today asked the service providers for a security audit of their systems, reported PTI. "The DoT has asked telecom operators to get a security audit of their systems," a senior government official said.
However, the officer also added that the telecom operator has informally said that the data in the breach incident as claimed by CloudSEK, seems to be an old data set of telecom subscribers. They further added that the breach did not happen due to the vulnerability in their system.
Recommended For You
CloudSEK had earlier said that its researchers have found that CYBO CREW affiliates CyboDevil and UNIT8200 have recently advertised a massive Indian Mobile Network Consumer Database for sale.
"This extensive mobile network database contains sensitive details belonging to a staggering 750 million individuals. It includes critical information like names, mobile numbers, addresses, and Aadhaar details. The sheer size of this dataset, totalling 1.8 terabytes, presents an alarming threat to security," CloudSEK said.
The hacker has denied any involvement in a breach and has claimed to have obtained the data through undisclosed asset work within law enforcement channels, CloudSEK said.
The cyber intelligence firm, collaborating with the government cybersecurity CERT-In, revealed that the breach was discovered on January 23. Following responsible disclosure practices, CloudSEK has notified the appropriate authorities and organisations that might be affected by the breach.
"The data, available for sale, is compressed to 600GB and uncompressed to 1.8 TB, posing significant risks to both individuals and organisations. The threat actor has demanded USD 3,000 for the entire dataset," the report said.
The exposure of Personally Identifiable Information (PII) poses significant risks to individuals and organisations alike. This includes potential financial losses, identity theft, harm to reputation, and heightened vulnerability to cyberattacks.
"The magnitude of this data leak cannot be overstated. With the personal information of 750 million individuals exposed, the potential for cyberattacks and identity theft is unprecedented. Telecom service providers and the government must validate the data and identify the loophole," CloudSEK, Threat Intelligence and Security Research, Sparsh Kulshrestha said.
He said the sample provided by the threat actor has been verified.
"The mobile numbers in question are associated with all the major Indian telecom operators, and the Aadhaar number provided is also confirmed as valid. We have promptly notified the relevant government authorities in India, as well as the concerned telecom operators," Kulshrestha said.