The Indian government has plugged a longstanding cybersecurity leak, which exposed vast amounts of citizens' data for over two years, after persistent complaints and follow-ups by an independent security researcher.
The Indian government's cloud service, known as S3WaaS, was found to be the point of leak. S3WaaS stands for Secure, Scalable and Sugamya Website as a Service. It has been touted as a cloud service which can "generate secure websites using GIGW (Guidelines for Government Websites)". The service has been aimed at making websites user friendly, bringing in uniformity and ensuring transparency, accessibility and seamless dissemination of information. The vulnerability, initially observed on January 16, 2022, exposed sensitive personal data, which could be readily accessed through a simple Google search. This data included Personally Identifiable Information (PII) such as the beneficiary's name, type of beneficiary, vaccination status, vaccination dose status, mobile number, document type (e.g., Aadhar, voter ID, PAN card, driver's license, passbook, passport, health insurance, service identity card, etc.), document number, age, pincode, state/union territory, district, block, facility, facility category, and registered date. These details were accessible because they were indexed by search engines. Additionally, numerous malicious actors also took advantage of the vulnerability and subsequently released the data on various data breach marketplaces. The breach turned out to be more extensive than initially expected. The misconfiguration vulnerability on the website enabled access to numerous confidential documents, including some containing sensitive and protected information of Indian citizens.
The Indian government's cloud service, known as S3WaaS, was found to be the point of leak. S3WaaS stands for Secure, Scalable and Sugamya Website as a Service. It has been touted as a cloud service which can "generate secure websites using GIGW (Guidelines for Government Websites)". The service has been aimed at making websites user friendly, bringing in uniformity and ensuring transparency, accessibility and seamless dissemination of information. The vulnerability, initially observed on January 16, 2022, exposed sensitive personal data, which could be readily accessed through a simple Google search. This data included Personally Identifiable Information (PII) such as the beneficiary's name, type of beneficiary, vaccination status, vaccination dose status, mobile number, document type (e.g., Aadhar, voter ID, PAN card, driver's license, passbook, passport, health insurance, service identity card, etc.), document number, age, pincode, state/union territory, district, block, facility, facility category, and registered date. These details were accessible because they were indexed by search engines. Additionally, numerous malicious actors also took advantage of the vulnerability and subsequently released the data on various data breach marketplaces. The breach turned out to be more extensive than initially expected. The misconfiguration vulnerability on the website enabled access to numerous confidential documents, including some containing sensitive and protected information of Indian citizens.