Delhi Police nabs Bihar man and minor in CoWin data breach probe

As reported by ANI, Delhi police officials note that the arrested individual is believed to have shared the compromised data on the messaging platform Telegram. The Delhi Police Special Cell has also detained a minor in relation to the suspected data breach of the Cowin Portal.

“The suspect’s mother is reported to be employed as a health worker in Bihar. Further information regarding the case is currently awaited,” Delhi Police noted.

Earlier on June 15, the Parliamentary Committee on Communication and IT met to discuss citizens’ data security and privacy. When asked about the status of enquiry in the alleged breach of data from the CoWIN portal, the government officials said that the data leaked by bots was collated from several sources.

“CoWIN was a breach-proof portal,” the government officials said.

Earlier on June 13, the government launched an investigation into a data breach after personal data of vaccinated citizens, including VVIPs, from the CoWin website was allegedly leaked via a Telegram messenger channel.

The government said the CoWin website, a repository of all data of those who have been vaccinated against covid-19, maintains strong data privacy safeguards. The health ministry stated that social-media reports claiming individuals’ data can be accessed from a Telegram bot bypassing the mobile number or Aadhaar number “are without any basis and mischievous in nature”.

Minister of state for electronics and information technology Rajeev Chandrasekhar said in a tweet that the data being accessed by the bot seems to have been populated with previously stolen data from databases other than CoWin.

He added that the government was reviewing the existing security systems of the CoWin portal. “It does not appear that the CoWin app or database has been directly breached,” he said. Chandrasekhar said CERT-In, under his ministry that looks into instances of data breaches, immediately responded to the allegations of a data breach.

The data breach claim has come as a major jolt to the government, which has been taking steps to digitize the economy and has built digital public infrastructure (DPI) based on the biometric identification number Aadhaar, individuals’ mobile numbers, and bank accounts as the backbone for the transfer of benefits and innovation in the private sector.

CERT-In, in its initial report, has pointed out that the back-end database for the Telegram bot was not directly accessing the APIs of the CoWin database.

In January 2021, the central government launched the CoWin portal as the digital platform to capture covid-19 vaccination programme details. It is owned and managed by the Union health ministry.

As of date, the CoWin dashboard shows that 1.11 billion individuals have registered on the portal. Since the start of the vaccination programme, nearly 2.21 billion doses have been administered so far.

(With inputs from agencies)

Updated: 22 Jun 2023, 10:15 AM IST