Bhim Information Leak Exposes Vii 1000000 Indians Data

     Data of to a greater extent than than 7 1 thou 1000 users of mobile payments app, BHIM or Bharat Interface Money, were exposed inwards a website breach revealing sensitive personal information, a study past times an online portal vpnMentor has revealed. The exposed information include information required for signing upward for the app such every bit fiscal details, photos, Aadhaar in addition to Permanent Account Number (PAN) menu details of to a greater extent than than 7 1 thou 1000 users. "The scale of the exposed information is extraordinary, affecting millions of people all over Republic of Republic of India in addition to exposing them to potentially devastating fraud, theft, in addition to laid on from hackers in addition to cybercriminals," the interrogation portal stated. However, NPCI has denied the claim.  

     According to vpnMentor, upon discovering the information breach inwards April, the squad outset approached the developers of Common Service Centres (CSC) e-Governance Services, who is behind the website data leak included personal identifiable information such every bit Aadhaar menu details, caste certificates, residence proof, depository fiscal establishment records, along alongside a consummate profile of individuals. 

National Payment Corporation of Republic of Republic of India (NPCI) Statement:

Image Credit: vpnMentor

     However, refuting the claims past times vpnMentor, NPCI stated: “We convey come upward across roughly tidings reports which advise information breach at BHIM App. We would similar to clarify that at that topographic point has been no information compromise at BHIM App in addition to asking everyone to non autumn prey to such speculations. NPCI follows high degree of safety in addition to an integrated approach to protect its infrastructure in addition to proceed to render a robust payments ecosystem." 

      The vpnMentor squad claims that the BHIM website was beingness used inwards a crusade to sign upward users in addition to trouble concern merchants to the app of which roughly related information was beingness stored on a "mis-configured Amazon Web Services S3 bucket in addition to was publicly accessible". S3 buckets are a pop shape of cloud storage across the basis but demand developers to laid the safety protocols on their accounts.

     The S3 bucket contained records from Feb 2019, every bit per the report. "However, fifty-fifty inside such a curt fourth dimension frame, over 7 1 thou 1000 records had been uploaded in addition to exposed... The S3 bucket also contained massive CSV lists of merchant businesses signed upward to BHIM, along alongside the trouble concern owner’s Unified Payment Interface (UPI ID) number," the portal stated. There were to a greater extent than than 1 1 thou 1000 such entries. 

     The vpnMentor interrogation squad discovered the mis-configuration inwards CSC’s S3 bucket every bit utilisation of a huge spider web mapping project. "The UPI payment organisation is similar to a depository fiscal establishment trouble concern human relationship inwards many ways. It would live on incredibly valuable to hackers, giving them access to vast amounts of information virtually a person’s finances in addition to depository fiscal establishment accounts. This information would brand illegally accessing those accounts much easier," the portal said explaining the gravity of the breach. "The exposure of BHIM user information is akin to a hacker gaining access to the entire information infrastructure of a bank, along alongside millions of its users’ trouble concern human relationship information."

     The website warns that cybercriminals could combine the information inwards many ways in addition to commit diverse crimes, including identity thefts in addition to taxation frauds. 

VPNMentor Statement:

     "The exposure of private information may also contribute to a broader deterioration of trust betwixt the Indian public, authorities bodies, in addition to technology scientific discipline companies. Data privacy is a huge concern for people from all sections of society, in addition to many people could live on reluctant to adopt a software tool linked to such a scandal," vpnMentor states. 

     A key government-blessed project, BHIM was a key driver of India's cashless transactions. Launched inwards 2016 past times nonprofit NPCI, the app clocked over 18.4 1 thou 1000 transactions every bit of Feb 2020.