7.26 million BHIM users’ data leaked: Report

An independent cyber security research firm has disclosed that a data leak from India’s BHIM payment app exposed personal data of 7 million Indians including addresses, scans of Aadhar IDs, and caste certificates

A report from cybersecurity company VPN Mentor suggests that the 409GB database was stored in a misconfigured AWS S3 bucket, making all data publicly accessible.

It is said that the research team discovered the unsecured database on April 23, and it notified India’s Computer Emergency Response Team (CERT-In) on April 28.

Although the data bucket no longer remains in public domain,it was open for anyone for over one year.

The firm said that the database contained records from February 2019. The database mostly contained onboarding documents to open a bank account such as scans of Aadhar IDs, caste certificates, proof of residence, Permanent Account Number (PAN) cards, and screenshots of fund transfers for proof.

However, the National Payments Corporation of India (NPCI) denied the claim, asking “everyone to not fall prey to such speculations”