Provident Fund (PF) facts of about 28 crore Indians was identified to have been leaked by hackers previously this thirty day period. A cybersecurity researcher from Ukraine, Bob Diachenko, produced the discovery on August 1 and uncovered that facts this sort of as Universal Account Variety (UANs), names, marital position, Aadhaar aspects, gender, and financial institution account particulars ended up uncovered on the web. In accordance to Diachenko, he uncovered two different net protocol (IP) addresses web hosting two clusters of leaked details. Each of these IPs had been hosted on Microsoft’s Azure cloud storage support.
Cybersecurity researcher Bob Diachenko comprehensive the leak in a write-up on LinkedIn. On August 2, Diachenko found out two independent IP clusters of knowledge that contained indices referred to as UAN. On examining the clusters, he identified that the 1st cluster contained 280,472,941 documents, whereas the second IP contained 8,390,524 information.
“After brief evaluation of the samples (utilizing a very simple browser), I was sure that I am searching at a thing major and important”, Diachenko reported in his publish. Nonetheless, he was not ready to discover who owned the details. Each the IP addresses were hosted on Microsoft’s Azure system and were India-centered. He was not able to obtain other information and facts by means of a reverse DNS evaluation.
The Shodan and Censys search engines from Diachenko’s SecurityDiscovery agency found these clusters on August 1. Even so, it is not crystal clear how extended the info was obtainable on the internet. The details could’ve been misused by hackers to acquire entry to the PF account. Data this kind of as identify, gender, Aadhaar specifics, could also be utilized to create fake identities and documents.
The researcher tagged the Indian Laptop or computer Crisis Response Team (CERT-In) in a tweet informing them about the leak. The CERT-In replied to his tweet inquiring him to supply a report of the hack in an electronic mail. Both equally IP addresses have been taken down inside of 12 several hours just after his tweet. Diachenko states that considering that August 3, no enterprise or agency has appear ahead to choose obligation for the hack
