Personal info of 3.5 million Indian travelers exposed in Covid-19 e-pass leak

A massive database with the personal information of 3.5 million Indian travelers was recently leaked online, according to researchers at Cybernews.

The team that stumbled upon the unprotected database during a routine investigation said the records contained sensitive details linked to citizens of India’s southernmost state, Tamil Nadu, who applied for the Covid-19 mandatory e-pass between 2020 and 2021.

The mandatory e-registration came into effect April 26, 2021, during the peak of the pandemic, and the researchers warn that individuals may be still at risk of identity-theft crimes.

“The sheer scale of the exposure underscores the urgency for robust cybersecurity measures and highlights the potential risks associated with the mishandling of sensitive personal data in the context of government-issued passes,” Cybernews investigators explained.

Leaked data includes:

· Names and gender

· Passport number or photocopies of passports

· Email addresses and mobile numbers

· Travel details or reason for traveling

· Vehicle numbers

The exposed records were linked to an open S3 bucket belonging to a third-party service provider. The researchers said they immediately notified the owners of the unprotected database, who quickly secured it to prevent further access.

Although the investigators could not confirm whether any malicious entities also have access to the database, users should monitor online accounts and keep an eye out for phishing attempts that leverage exposed information.

If your passport or ID information has been stolen or exposed in a breach, immediately report it to your local authorities.

Want to stay on top of data breaches and leaks that can harm your finances and identity?

Use Bitdefender Digital Identity Protection to continuously monitor the extent of the digital you and track down any data leaks that involve your personally identifiable information.

Our dedicated identity protection service gives you a 360-degree view of your online identity while scanning the deep and dark web to check if your information is leaked or exposed. You receive notifications about the event and details about your data, as well as easy-to- use one-click action items to minimize risks.