Researcher Claims – Data of EPFO ​​Pension Scheme Holders Exposed Online

Cyber Security Researcher

A Ukrainian cyber security researcher and journalist has claimed that around 288 million personal records containing full names, bank account numbers and enrolled information of Employees’ Pension Scheme (EPS) holders in India’s Employees’ Provident Fund Organization (EPFO) have been deleted from the Internet previously exposed online.

The security researcher’s claim about the data exposed online is yet to be verified by the EPFO, national cyber agency CERT-In or the IT ministry.

SecurityDiscovery.com director of cyber threat intelligence and journalist Bob Diachenko claimed that his system identified two different IPs with Universal Account Number (UAN) data.

An IP Address is A Unique Address That identifies A Device on the Internet or Local Network. IP Stands For Internet Protocol

He wrote in a blogpost that “UAN stands for Universal Account Number and is an important part of the Registry of the Government of India. UAN is allotted by the EPFO.”

Each record contains personal information, including marital status, gender and date of birth, UAN, bank account number and employment status, among others.

The researcher claimed that while more than 280 million records were available under one IP address, about 8.4 million data records were publicly exposed in another IP address.

Diachenko claimed, “Given the scale and apparent sensitivity of the data, I decided to tweet about it without giving any details as to the source and related information. Both IPs were deleted within 12 hours of my tweets.” and is now unavailable.”

“As of August 3, I have not received any response from any agency or company that would claim responsibility for the data received,” he said.

According to the Security Researcher, “Both the IPs Were Azure-Hosted and India-Based.”

The security researcher added, “Even through reverse DNS analysis, no other information was found. Both Shodan and Sensys search engines picked them up on August 1, but it is unknown how long this information could be kept from indexing search engines.” was exposed earlier.”

He also tweeted: “(Breach Alert) Over 28 crore records in this Indian database, publicly exposed. Where to report?”

He said that both the IPs have now been taken out of the public domain.

Trending Today

The latest on what’s moving world – delivered straight to your inbox