Hours after reports of the alleged CoWIN data breach surfaced, the Indian government refuted the claims stating that the Health Ministry’s CoWIN platform was “completely safe”.
The alleged CoWIN data breach incident stated that the personal information of Indian citizens registered with the CoWIN portal was available on messaging app Telegram.
The Ministry of Health and Family Welfare refuted the claims and issued an official report ‘titled CoWIN data breach’, addressing the incident.
“There are some media reports claiming breach of data of beneficiaries who have received COVID vaccination in the country, on some social media platforms. These reports allege breach of data from the Co-WIN portal of the Union health Ministry, which is repository of all data of beneficiaries who have been vaccinated against COVID19,” read the statement,
“Certain posts on the social media platform Twitter have claimed using a Telegram (online messenger application) BOT, the personal data of individuals who have been vaccinated is being accessed. It is reported that the BOT has been able to pull individual data by simply passing the mobile number or Aadhaar number of a beneficiary.”
Calling such reports “without any basis” and “mischievous in nature”, the ministry clarified that the CoWIN portal was “completely safe with adequate safeguards for data privacy”.
Read More About The CoWIN Data Breach Here
Elaborating on the security measure, the statement read, “There are security measures in place on Co-WIN portal, with Web Application Firewall, Anti-DDoS, SSL/TLS, regular vulnerability assessment, Identity & Access Management etc. Only OTP authentication-based access of data is provided.
The statement further explained that the development team of COWIN confirmed that there were no public APIs where data can be pulled without an OTP. However, elaborated that one such API had a feature of sharing the data by calling using just a mobile number of Aadhaar.
“However, even this API is very specific and the requests are only accepted from a trusted API which has been white-listed by the CoWIN application,” the statement read.
Following the speculations around the alleged CoWIN data breach, the Union Health Ministry requested the Indian Computer Emergency Response Team (CERT-In) to investigate the issue and submit the report.
However, the initial report by CERT-In noted that the backend database for Telegram bot was not directly accessing the APIs of CoWIN database.
An internal probe to review the existing security measures of CoWIN has also been initiated.
What triggered the CoWIN data breach fiasco?
On June 12, several Indian media organizations reported that the CoWIN portal, the central platform for COVID-19 vaccination registration in India, had suffered a major data breach making the data of billions of registered users available for exploitation.
In a report, Kerala-based Malayala Manorama stated that the details could be easily accessed after a person’s number was entered. All the details shared by the registered number were being shared instantly via a Telegram bot.
The details of several individuals including those of renowned politicians was allegedly exposed. Trinamool Congress (TMC) leader Saket Gokhale was among the first to share several screenshots displaying the leaked details.
These included of India’s Former Union Minister P. Chidambaram, Secretary of the Union Health Ministry, Rajesh Bhushan and his wife, Ritu Khanduri Bhushan who is a Member of the Legislative Assembly from Uttarakhand, Central opposition leaders Jairam Ramesh and K.C. Venugopal, among others.
