Wednesday , June 4 2025
face recognition

Researcher claimed: Biometrics of Indian Forces Exposed

Jeremiah Fowler, a security researcher, claimed to discover a major vulnerability in India’s data security. He found an unprotected database with a large amount of biometric data, such as fingerprints, facial scans, and other sensitive information, belonging to millions of Indian citizens.

Jeremiah Fowler published his findings on global planet. “a non-password-protected database that contained over 1.6 million documents belonging to an Indian leading provider of biometric authentication solutions, with offices in the USA and Australia.

CVSS 9.6: IBM QRadar & Cloud Pak Security Flaws Exposed

IBM has issued a security advisory for vulnerabilities in its QRadar Suite Software and Cloud Pak for Security platforms. These...
Read More
CVSS 9.6: IBM QRadar & Cloud Pak Security Flaws Exposed

ALERT
Thousands of IP addresses compromised nationwide: CIRT warn

As Bangladesh prepares for the extended Eid-ul-Adha holidays, the BGD e-GOV Computer Incident Response Team (CIRT) has issued an urgent...
Read More
ALERT  Thousands of IP addresses compromised nationwide: CIRT warn

New Android Malware ‘Crocodilus’ Targets Banks in 8 Countries

In March 2025, the Threatfabric mobile Threat Intelligence team identified Crocodilus, a new Android banking Trojan designed for device takeover....
Read More
New Android Malware ‘Crocodilus’ Targets Banks in 8 Countries

Qualcomm Patches 3 Zero-Days Used in Targeted Android Attacks

Qualcomm has issued security patches for three zero-day vulnerabilities in the Adreno GPU driver, affecting many chipsets that are being...
Read More
Qualcomm Patches 3 Zero-Days Used in Targeted Android Attacks

Critical RCE Flaw Patched in Roundcube Webmail

Roundcube Webmail has fixed a critical security flaw that could enable remote code execution after authentication. Disclosed by security researcher...
Read More
Critical RCE Flaw Patched in Roundcube Webmail

Hacker claim Leak of Deloitte Source Code & GitHub Credentials

A hacker known as "303" claim to breach the company's systems and leaked sensitive internal data on a dark web...
Read More
Hacker claim Leak of Deloitte Source Code & GitHub Credentials

CISA Issued Guidance for SIEM and SOAR Implementation

CISA and ACSC issued new guidance this week on how to procure, implement, and maintain SIEM and SOAR platforms. SIEM...
Read More
CISA Issued Guidance for SIEM and SOAR Implementation

Linux flaws enable password hash theft via core dumps in Ubuntu, RHEL, Fedora

The Qualys Threat Research Unit (TRU) found two local information-disclosure vulnerabilities in Apport and systemd-coredump. Both issues are race-condition vulnerabilities....
Read More
Linux flaws enable password hash theft via core dumps in Ubuntu, RHEL, Fedora

Australia enacts mandatory ransomware payment reporting

New ransomware payment reporting rules take effect in Australia yesterday (May 30) for all organisations with an annual turnover of...
Read More
Australia enacts mandatory ransomware payment reporting

Why Govt Demands Foreign CCTV Firms to Submit Source Code?

Global makers of surveillance gear have clashed with Indian regulators in recent weeks over contentious new security rules that require...
Read More
Why Govt Demands Foreign CCTV Firms to Submit Source Code?

The exposed records included the biometric identity information of members of the police, army, teachers, and railway workers. In parallel, it appeared that the data might have been for sale on a dark web related Telegram group” websiteplanet report reads.

It is estimated that the amount of exposed data 500GB, reportedly originated from two Indian firms, ThoughtGreen Technologies and Timing Technologies, both of which provide application development and biometric verification services. The leak included biometric data not only from police and military personnel but also from civilians, such as teachers and railway workers.

Websiteplanet post reads, “The records span from 2021-2024 and were actively updating in real time during my research. There were 284,535 documents marked as Physical Efficiency Test (PET) for police and law enforcement officers. The database also stored images of 143,173 signatures and a very large number of .PDF documents that contained the name, images, and fingerprints of multiple individuals. I saw numerous files featuring the biometric data of individuals who appeared to be high-ranking military personnel. The database also contained several mobile applications and installation files compressed in .zip format.”

Source: websiteplanet

Hackread reported, “Fowler noted that this data might already be up for sale on a Telegram group, which could put millions at risk of a wide range of threats”.

Biometric data, like fingerprints, are unique identifiers linked to someone’s identity. They can’t be easily changed, which makes them ideal for malicious activities like impersonation and identity theft.

“We take data security very seriously, have taken immediate steps to secure the exposed data,” a member of ThoughtGreen Technologies wrote in an email to WIRED. “Due to the sensitivity of data, we cannot comment on specifics in an email. However, we can assure you that we are investigating this matter thoroughly to ensure such an incident does not occur again.” Wired reported.

Shivangi Narayan, an independent researcher in India, told to media that the country’s data protection law needs to be made more robust, and companies and organizations need to take greater care with how they handle people’s data. “A lot of data is collected in India, but nobody’s really bothered about how to store it properly,” Narayan says. Data breaches are happening so regularly that people have “lost that surprise shock factor,” Narayan says. In early May, one cybersecurity company said it had seen a face-recognition data breach connected to one Indian police force, including police and suspect information.

The incident highlights the urgent need for robust data security measures in India. Stringent regulations and data protection protocols are essential to safeguard sensitive information and prevent similar breaches in the future.

Increase in attacks targeting India
A Cisco survey last year showed that nearly 80% of Indian respondents reported cybersecurity incidents, significantly higher than the global average.
A Russian hacktivist group hacked India’s health management system last year, putting the health data of millions of citizens at risk.
The All India Institute of Medical Sciences (AIIMS), the country’s leading medical institute, was attacked by ransomware in 2022. As a result, it had to switch to manual operations and experienced disruptions in important services.
In 2021, Air India had a cybersecurity breach that affected 4.5 million passengers. Also, in the same year, personal information of 500,000 Indian police personnel was offered for sale on a data-sharing forum.
In another incident, exam data and results for 190,000 candidates from a 2020 national-level competitive exam were leaked and sold on a cybercrime forum.

Source: Wired, CSO ONLINE, Hackread, Arabianpost, Websiteplanet,  

(Media Disclaimer: This report is based on research conducted internally and externally using different ways. The information provided is for reference only, and users are responsible for relying on it. Infosecbulletin is not liable for the accuracy or consequences of using this information by any means)

 

Check Also

GitHub

Hacker claim Leak of Deloitte Source Code & GitHub Credentials

A hacker known as “303” claim to breach the company’s systems and leaked sensitive internal …

Leave a Reply

Your email address will not be published. Required fields are marked *