Govt dismisses CoWIN data leak reports; will start probe

The health ministry was responding to reports saying personal data of thousands of people in India was leaked from a government server that included their personal details

Union health ministry on Friday dismissed reports of a data leak from the CoWIN portal that is used to manage the Covid vaccination drive in the country.

The leaked data reportedly was put on sale on a website called Raid Forums

“There have been several media reports claiming that the data stored in Co-WIN portal has been leaked online. It is clarified that no data has leaked from Co-WIN portal and the entire data of residents is safe and secure on this digital platform,” read a ministry statement.

“It is also clarified that while Union Ministry of Health and Family Welfare will enquire into the substance of the news, prima facie the assertion is not correct, as Co-WIN collects neither the address of the person nor the RT-PCR test results for COVID-19 vaccination,” it added.

The health ministry was responding to reports saying personal data of thousands of people in India was leaked from a government server that included their name, mobile number, address and Covid test result, and the information could be accessed through an online search.

The leaked data reportedly was put on sale on a website called Raid Forums. A post claimed to have personal data of over 20,000 people. The data on that website shows name, age, gender, mobile number, address, date and result of Covid-19 report of accounts.

Cyber Security researcher Rajshekhar Rajaharia also tweeted that personally identifiable information (PII) including name and Covid-19 results are made public through a content delivery network (CDN).

He said that Google has indexed lakhs of data points from the affected system.

“PII including Name, MOB, PAN, Address etc of #Covid19 #RTPCR results & #Cowin data getting public through a Govt CDN. #Google indexed almost 9 Lac public/private #GovtDocuments in search engines. Patient’s data is now listed on #DarkWeb. Need fast deindex,” Rajaharia said in his tweet.

The sample document shared on Raid Forums shows that the leaked data was meant for upload on Co-WIN portal.

With inputs from PTI