Delhi: Four held in ICMR data leak case

New Delhi, Dec 18: Delhi Police has arrested four people in connection with the data leak from the Indian Council of Medical Research (ICMR).

The arrests follow an investigation by central probe agencies, revealing that personal details of more than 81 crore Indians were compromised and offered for sale on the dark web, originating from the ICMR's data bank.

The accused were taken into custody after a massive hunt in three different states, said the sources.

The sources suggest that the accused, who had reportedly met on a gaming platform, conspired to hack the data and capitalise on the sale for quick financial gains.

Earlier this year, the Cyber cell of Delhi Police took suo motu cognizance of the situation after reports surfaced regarding the significant data breach.

In October this year, in a massive data breach, data of over 81.5 crore citizens held with the ICMR were on sale on the dark web, which contained crucial information such as Aadhaar and passport details, along with names, phone numbers, and addresses.

The data breach noticed by the US-based cybersecurity and intelligence firm Resecurity mentioned that "on October 9, a threat actor going by the alias ‘pwn0001’ posted a thread on Breach Forums brokering access to 815 million Indian Citizen Aadhaar and Passport records".

Moreover, the cybersecurity analysts found one of the leaked samples containing 100,000 records of PII (personally identifiable information) related to Indian residents.

In this sample leak, the analysts identified valid Aadhaar Card IDs, which were corroborated via a government portal that provides a 'Verify Aadhaar' feature.

The analysts also managed to connect with the threat actor and learned they were willing to sell the entire Aadhaar and Indian passport dataset for $80,000 (over Rs 66 lakh).