LPG brand Indane leaked millions of Aadhaar numbers: French security researcher

Baptiste Robert wrote in a blog post on Medium late Monday that the Aadhaar data of nearly 6.7 million dealers and distributors of Indane, accessible only with a valid username and password.

Published: 19th February 2019 10:38 AM  |   Last Updated: 19th February 2019 10:38 AM   |  A+A-

Aadhaar Card

Image used for representational purpose only.

By IANS

NEW DELHI: A French researcher has claimed that he found a security lapse that allegedly exposed millions of Aadhaar numbers of dealers and distributors associated with Indane, an LPG brand owned by the Indian Oil Corporation (IOC).

Baptiste Robert, who goes by the online handle Elliot Alderson and has exposed Aadhaar leaks in the past, wrote in a blog post on Medium late Monday that the Aadhaar data of nearly 6.7 million dealers and distributors of Indane, accessible only with a valid username and password, was left exposed.

"Due to a lack of authentication in the local dealers portal, Indane is leaking the names, addresses and the Aadhaar numbers of their customers," said Alderson.

Using a custom-built script to scrape the database, Alderson found customer data for nearly 11,000 dealers, including names and addresses of customers, before his IP was blocked by Indane.

"I wrote the python script. By running this script, it gives us 11062 valid dealer ids. After more than 1 day, my script tested 9,490 dealers and found that a total of 5,826,116 Indane customers are affected by this leak," he wrote.

The French researchers found 5.8 million Indane customer records before his script was blocked.

"Unfortunately, Indane probably blocked my IP, so I didn't test the remaining 1,572 dealers. By doing some basic math we can estimate the final number of affected customers around 6,791,200," Alderson added.

Indane and the Unique Identification Authority of India (UIDAI) were yet to comment on this data leak.

Stay up to date on all the latest Nation news with The New Indian Express App. Download now
(Get the news that matters from New Indian Express on WhatsApp. Click this link and hit 'Click to Subscribe'. Follow the instructions after that.)

Comments

Disclaimer : We respect your thoughts and views! But we need to be judicious while moderating your comments. All the comments will be moderated by the newindianexpress.com editorial. Abstain from posting comments that are obscene, defamatory or inflammatory, and do not indulge in personal attacks. Try to avoid outside hyperlinks inside the comment. Help us delete comments that do not follow these guidelines.

The views expressed in comments published on newindianexpress.com are those of the comment writers alone. They do not represent the views or opinions of newindianexpress.com or its staff, nor do they represent the views or opinions of The New Indian Express Group, or any entity of, or affiliated with, The New Indian Express Group. newindianexpress.com reserves the right to take any or all comments down at any time.

flipboard facebook twitter whatsapp