Data on Indian Mobile Payments App Reportedly Exposed via Open S3 Bucket
Over 7 million records exposed, according to vpnMentor, but app maker says there is no sign of malicious use.
June 1, 2020
Data belonging to millions of Indian citizens who had signed up for a mobile payment app called BHIM may have been put at risk of misuse after it was left exposed and unencrypted in a misconfigured Amazon S3 storage bucket.
Researchers at VPN review service vpnMentor recently discovered the S3 bucket connected to a website that is being used to promote adoption of the payment app and to sign up new individual users and merchant businesses.
In a report, vpnMentor described the storage bucket as containing 409GB of data representing some 7.26 million records containing information needed to open a BHIM account. The data included scans of national ID cards; photos used as proof of residence; professional certificates, degrees, and diplomas; and names, date of birth, and religion. Also included in the data set were ID numbers for government programs and biometric identifiers such as fingerprint scans.
The personal user data contained in the dataset provided "a complete profile of individuals, their finances, and banking records," vpnMentor said. "Having such sensitive financial data in the public domain or the hands of criminal hackers would make it incredibly easy to trick, defraud, and steal from the people exposed," it noted.
In addition to data on individuals, the S3 bucket also contained "massive CSV lists" with information on merchants that had signed up for BHIM and the IDs used by business owners to make payment transfers via the app. Similar IDs belonging to over 1 million individuals may also have been potentially exposed via the misconfigured S3 bucket. Such IDs make it much easier for hackers to illegally access bank accounts belonging to the impacted individuals vpnMentor said.
However, the National Payments Corporation of India (NPCI), which launched BHIM in 2016, on Monday denied that any user data had been compromised and urged its users not to fall prey to what it described as speculative news reports. The organization claimed it followed highly secure practices and an "integrated approach" to protect its payments infrastructure and user data.
But Lisa Taylor, a researcher at vpnMentor, insists the breach happened.
"The fact remains that PII data of millions of Indian citizens was left unprotected on a public bucket," she says. "Instead of looking into the faults that lead to this breach and make sure they won't happen again, we are faced with ridiculous claims it never happened."
According to Taylor, vpnMentor confirmed a company named CSC BHIM as the owner of the storage bucket that contained the sensitive data. "The CSC BHIM site mentions NPCI and Punjab national bank as their partners," she says. The site features photos related to BHIM promotions in various parts of India, under the BHIM logo, Taylor adds. "The site itself bears the BHIM logo, as well as that of the Indian ministry of electronics and information."