The semi-government organisation which manages India's massive Aadhaar database has threatened to take legal action against the technology website ZDNet over a report that claimed a new leak had hit the national ID database.
The story, written by the site's Zack Whittaker for a section known as Zero Day on 23 March, claimed that "The data leak affects potentially every Indian citizen subscribed to the database."
Aadhaar, which means "foundation", is a 12-digit unique ID number issued to all Indian residents based on their biometric and demographic data. It is an ambitious attempt to create a digital resource for controlling what a resident can, and cannot do. It has more than 1.19 billion enrolled members as of 30 November 2017.
The Unique Identification Authority of India manages the database. In a statement issued on Twitter, it said: "We refute the reports in a certain section of media sourced from ZDNet which quote a person purportedly claiming to be a security researcher that a state-owned utility company has vulnerability which can be used to access huge amount of Aadhaar data including banking details."
We refute the reports in a certain section of media sourced from ZDNet which quote a person purportedly claiming to be a security researcher that a state-owned utility company has vulnerability which can be used to access huge amount of Aadhaar data including banking details. 1/8
— Aadhaar (@UIDAI) 24 March 2018
{loadposition sam08}And it added: "The story is totally baseless, false & irresponsible. It purports that the database of a state Utility company containing its customer details such as bank account numbers, consumer number, Aadhaar number (not the biometrics), etc., has vulnerability. Even if the claim purported in the story were taken as true, it would raise security concerns on database of that Utility Company and has nothing to do with security of UIDAI’s Aadhaar database."
In response, Whittaker tweeted that the site stood behind the story and attached some of the data that he had obtained from the alleged leak, with appropriate redactions.
In response to @UIDAI's denying an Aadhaar data leak, here are a couple of exposed records (some information was redacted to protect the data). It includes name, Aadhaar number, consumer number, and some linked banking data.
— Zack Whittaker (@zackwhittaker) 24 March 2018
We stand by our story. https://t.co/zU3jsAdGV9 pic.twitter.com/voa53Ut0gW
This is the second time in recent times that leaks in the Aadhaar database have been alleged. In January, as iTWire reported, India's The Tribune newspaper reported that personal details of Indians were being sold cheaply online.