CoWIN data breach: Two held over involvement in data leak

Representational Image

A man from Bihar was arrested and a juvenile was apprehended in connection with their involvement in the alleged data leak from CoWIN portal, officials told news agency PTI on Thursday.

The man is alleged to have used a Telegram app to leak the data, they said.

According to PTI, there have been claims about a breach of data of citizens registered on the CoWIN platform, and opposition parties have asked the government to take deterrent action.

The government has termed such reports "mischievous" and "without any basis" while asserting that the CoWIN portal is completely safe with adequate safeguards for data privacy.

The matter was sent for a review by the country's nodal cyber security agency CERT-In, which said in its initial report, that the backend database for the Telegram bot, which is at the centre of the alleged leak, was not directly accessing the APIs of the CoWIN database.

In a statement, the Union Health Ministry also said that an internal exercise has been initiated to review the existing security measures.

CoWIN portal is a repository of all data of all those who have been vaccinated against COVID-19 in the country.

Meanwhile, Opposition parties demanded an inquiry into claims about a breach of data of citizens registered on the CoWIN platform and asked the government to take deterrent action.

Rajeev Chandrasekhar, the Union Minister of State for Information Technology, said the Indian Computer Emergency Response Team (CERT-In) responded immediately after the alleged leak.

It does not appear that the CoWIN app or database were directly breached, he said.

But the Congress demanded a high-level judicial probe into the entire data management apparatus of the government to identify the "extent of danger" posed to privacy of all Indians.

Congress general secretary (Organisation) K C Venugopal said the duty of any entity, especially the government, is to protect individual privacy above everything else. "It is clear that no citizen can trust this government with its private information. Only an impartial, high-level judicial probe into the government's entire data management apparatus can identify the extent of danger that is posed to our privacy as a result of this government's carelessness," Venugopal said on Twitter.

He also hit out at Union Minister of State for Electronics and Technology Chandrasekhar, saying, "I am appalled at your casual response to the breach of privacy of 1.4 billion Indians."

Congress general secretary in-charge communications Jairam Ramesh said the personal data breach is a "very grave matter" with serious implications for privacy, security and makes us all vulnerable to financial frauds.

Hitting out at Chandrasekhar, he said, "The tech-savvy Minister instead of issuing casual WhatsApp forward style tweets should hold a Press Conference at the earliest and clarify at the very least: What he means by 'previously stolen data stolen in the past', stolen from which database, when, and what action was taken?"

"If CoWIN database hasn't been 'directly breached', is the Minister then accepting that it is an indirect breach? What other databases are linked to the CoWIN database that has led to this vulnerability?" Ramesh said.

"What immediate steps is the Modi government taking to secure the personal data of crores of Indians who trusted the govt to keep their details safe," he asked.

Congress leaders also alleged it was a case of "criminal negligence" and asked why the government was sitting on a data protection law.

"In its Digital India frenzy, GoI has woefully ignored citizen privacy. Personal data of every single Indian who got the Covid-19 vaccination is publicly available. Including my own data. Who let this happen? Why is GoI sitting on a data protection law?" Congress MP Karti Chidambaram said.

(With inputs from PTI)