Cyberabad police crackdown after data of 670 mn people stolen: What we know

Last week, the Police arrested a Faridabad resident Vinay Bhardwaj, who was allegedly involved in stealing, holding and selling personal and confidential data

The Cyberabad Police, one of the three police commissionerates in Hyderabad, has issued notices to 11 organisations, including three banks, a social media giant and an Information Technology services company, asking their representatives to appear before it in connection with a breach of data of 670 million people across the country.

Last week, they arrested a Faridabad resident Vinay Bhardwaj, who was allegedly involved in stealing, holding and selling personal and confidential data of individuals and organisations across 24 states and eight metropolitan cities.

The accused was operating through a website, "InspireWebz", at Faridabad, Haryana and selling databases to clients through cloud drive links, police said.

According to a report by the news agency PTI, The accused was found in possession of the data of students of edtech organisations as well as the GST details of persons and companies, and the consumer/customer data of major organisations such as road transport corporations of various states, major e-commerce portals, social media platforms and fintech companies.

The user data was taken from websites like Byju's, Vedantu, Amazon, Instagram, YouTube, Paytm, Phonepe etc.

Who received the notices from the police?

The 11 organisations to whom the notices were issued include two PSU banks and one private bank, a social media giant, an IT services company, an online grocery seller, a digital payments app and an online insurance platform, police said.

The 11 organisations' representatives have been told to appear before the police during the next one week to furnish details on how the companies maintained their databases, what procedures and policies were followed in this regard and who could access the data. This could help investigators ascertain how the database was leaked and accessed by an "unauthorised" person, among other relevant details, police said.

What has been recovered?

The police seized two mobile phones and two laptops, and data of 135 categories containing sensitive information of government, private organisations and individuals.

According to the Police's press release, some of the important data held by the accused includes the data of defence personnel, government employees, PAN card holders, data of 9th, 10th, 11th and 12th standard students, senior citizens, Delhi electricity consumers, demat account holders, mobile numbers of various individuals, NEET students, high net worth individuals, insurance holders, credit card and debit card holders among others.

Have similar attacks taken place earlier too?

In March, Cyberabad Police arrested seven people from a gang who were allegedly involved in the theft and sale of sensitive data of the government and important organisations, including details of 25.5 million defence personnel as well as the personal and confidential data of about 168 million citizens across the country.

Why is the case significant?

The case becomes all the more significant as India does not have robust data protection laws. Currently, certain provisions of the Information Technology Act govern the cases of data mishandling, selling, storage of confidential data etc.

(With agency inputs)