On the night of June 11, a journalist from the Kerala-based information portal The Fourth reported {that a} Telegram bot in a channel referred to as “hak4learn” was providing entry to the personal knowledge of thousands and thousands of Indians. All a consumer needed to do was put in a telephone quantity or Aadhaar (India’s nationwide ID) quantity, and it will return particulars together with their title, passport quantity, and date of beginning. The knowledge seems to have come from India’s CoWIN vaccination monitoring app, which has greater than 1 billion registered customers.

“The scale of the data breach is what makes it hard to guess the repercussions,” says Srikanth Lakshmanan, a researcher who runs the digital funds collective Cashless Consumer. “Conservative estimates mean at least personal data of several hundred million users was exposed.”

Local information shops have been ready to make use of the bot to access the personal information of politicians. WIRED couldn’t independently confirm their reporting; by the morning of June 12 the bot was inactive. The undeniable fact that it has shut down doesn’t imply the breach is over, Lakshmanan says, because the bot was doubtless only a store window for whoever accessed the database.

“Usually, hackers reveal a slice of data publicly via a bot or web page to prove to the world they have said data and then sell it on the dark web,” Lakshmanan says. “While the bot is down now, we don’t know where all the data is being traded.”

India’s digital public infrastructure has expanded massively over the past several  years, with the growing popularity of the Aadhaar identity system, the proliferation of the digital payments system United Payments Interface, and the launch of CoWIN.

This growth has meant that there is a vast amount of public data on file, but digital rights experts worry that cybersecurity and legal frameworks around data storage haven’t kept pace with the growth.

“The data involved with government entities is organically very large,” says Tejasi Panjiar, an affiliate counsel on the Internet Freedom Foundation, a company that advocates for digital rights. “Which is why there needs to be very strict data-security standards for government-based entities.”

Panjiar further said that the concern is that India doesn’t have a cybersecurity policy and that even the current data-protection framework “takes away that aspect of compensation that affected users would get,” making such leaks an even bigger cause for concern. “I think it’s a time for worry for everyone who’s been vaccinated through CoWIN,” added Panjiar.

The well being ministry has stated that claims that the CoWIN portal has been breached are “without any basis” and that the Computer Emergency Response Team, the company accountable for responding to cybersecurity incidents, has been requested to research.

India’s IT minister, Rajeev Chandrasekhar, tweeted that the data accessed by the bot is from a “threat actor database” and that “it does not appear that CoWIN app or database has been directly breached.”

An independent report by digital threat monitoring platform CloudSEK appears to validate this to some extent. The firm’s analysis means that moderately than getting access to the whole CoWIN database or backend, the hackers could have as a substitute gotten maintain of a number of credentials from well being staff, permitting them extra restricted entry to information.