New Delhi: Two months after central intelligence agencies found that personal details of more than 81 crore Indians were leaked from the data bank of the Indian Council of Medical Research (ICMR) and put on sale on the dark web, Delhi Police has arrested four men from three states.
During questioning, the suspects claimed to have also stolen data of the Federal Bureau of Investigation (FBI) and Computerised National Identity Card (CNIC) — Pakistan’s Aadhaar counterpart — The Indian Express has learnt.
A senior officer in a central agency said that Delhi Police took suo motu cognizance of the data leak earlier this month and registered an FIR.
“Last week, four men — a B.Tech degree holder from Odisha, two school dropouts from Haryana and one from Jhansi — were arrested and produced before a Delhi court which remanded them in seven days police custody,” the officer said.
“The arrested persons told investigators during initial questioning that they met on a gaming platform around three years ago and became friends. They then decided to earn quick money,” the officer said.
The breach was detected in October after intelligence officers came across the data — including Aadhaar and passport records — on the dark web.
“The matter was reported to the Indian Computer Emergency Response Team (CERT-In), the national nodal agency to deal with cyber security threats such as hacking and phishing, which in turn first verified with the departments concerned about the authenticity of the data and asked them to match with the actual data. They found there was data of around 1 lakh people as a sample from which they picked data of 50 people for verification and found them matching,” the officer said.
The breach was detected in October after intelligence officers came across the data — including Aadhaar and passport records — on the dark web.
“The matter was reported to the Indian Computer Emergency Response Team (CERT-In), the national nodal agency to deal with cyber security threats such as hacking and phishing, which in turn first verified with the departments concerned about the authenticity of the data and asked them to match with the actual data. They found there was data of around 1 lakh people as a sample from which they picked data of 50 people for verification and found them matching,” the officer said.
American cyber security and intelligence agency Resecurity, which initially noticed the breach, in a blogpost wrote, “On 9 October, a threat actor going by the name ‘pwn0001’ posted a thread on Breach Forums brokering access to 815 million ‘Indian Citizen Aadhaar & Passport’ records. In early October, Resecurity’s HUNTER (HUMINT) unit identified millions of personally identifiable information records, including Aadhaar cards, belonging to Indian residents being offered for sale on the Dark Web. The total number of the affected citizens is a matter of in-depth investigation by authorities, but the concerning fact that the data is valid and sensitive.”
Last month, Union Minister of State for Electronics and IT Rajeev Chandrasekhar told reporters in Bhopal, “There is evidence of leakage and investigation is going on, but the data was not stolen. Various departments had Covid-related data pertaining to testing, vaccination, diagnosis, etc. Several people were given access for these databases. There is evidence of a leakage there. Investigation is on.”
