New Delhi, Aug 4 (SocialNews.XYZ) A Ukraine-based cybersecurity researcher and journalist has claimed that about 288 million personal records, containing the full name, bank account number and nominee information of the Employees' Pension Scheme (EPS) holders in the Employees' Provident Fund Organisation (EPFO), were exposed online before being taken off the Internet.
The security researcher's claim about the data exposed online was yet to be verified by the EPFO, national cyber agency CERT-In or the IT Ministry.
Bob Diachenko, cyber threat intelligence director and journalist at SecurityDiscovery.com, claimed that their systems identified two separate IPs with Universal Account Number (UAN) data.
An IP address is a unique address that identifies a device on the internet or a local network. IP stands for "Internet Protocol."
"UAN stands for Universal Account Number and this is an important part of the Indian government registry. UAN is allotted by EPFO, he wrote in a blogpost.
Each record contained personal information, including marital status, gender and date of birth, UAN, bank account number and employment status, among others.
While 280 million records were available under one IP address, the other IP address had about 8.4 million data records publicly exposed, claimed the researcher.
"Given the scale and obvious sensitivity of data, I decided to tweet about it, without giving any details as of source and associated info. Within 12 hours after my tweet both IPs were taken down and now unavailable," Diachenko claimed.
"As of August 3rd, I did not hear back from any agency or company who would claim responsibility for the data found," he added.
According to the security researcher, "both IPs were Azure-hosted and India-based".
"No other information was obtained through reverse DNS analysis as well. Both Shodan and Censys search engines picked them up on August 1st, but it is unknown for how long this information was exposed before search engines indexed them," the security researcher said.
He also tweeted: "[BREACH ALERT] 280M+ records in this Indian database, publicly exposed. Where to report? @IndianCERT?"
Both the IPs have now been taken down from public domain, he informed.
Source: IANS
About Gopi
Gopi Adusumilli is a Programmer. He is the editor of SocialNews.XYZ and President of AGK Fire Inc.
He enjoys designing websites, developing mobile applications and publishing news articles on current events from various authenticated news sources.
When it comes to writing he likes to write about current world politics and Indian Movies. His future plans include developing SocialNews.XYZ into a News website that has no bias or judgment towards any.
He can be reached at gopi@socialnews.xyz