On Monday, several Indian media reported that India’s COVID-19 vaccine booking portal, CoWIN, was compromised, and sensitive personal information of thousands of users was leaked on the Telegram social messaging app.

It was claimed that a Telegram bot was revealing sensitive data of the users when inquired about an individual’s phone number. The bot leaked the name, Aadhaar number, PAN number, passport number, date of birth, location, gender, and the institute from where they got vaccinated.

Notably, a user had to save some of these details while registering for the CoWIN app.

Millions of Indian users had signed up on CoWIN portal, launched on January 16, 2021, and have used it to book vaccination slots. The data includes more than 40 million children aged between 12-14 and over 37 million people over the age of 45, a significant part of which could be senior citizens.

Now, it is no longer possible to access this bot.

<h2>Indian government’s response</h2>

There were two, slightly different, reactions from the government.

The first one was issued by the Indian health ministry which outrightly rejected claims of data leak saying that "all such reports are without any basis and mischievous in nature".

In a press release, the health ministry said that there are three ways in which data on CoWIN can be accessed.

First, a user can access their data on the portal through a one-time password (OTP) sent to their mobile number.

&nbsp;Two, a vaccinator can access the data of a person, and the CoWIN system tracks and records each time an “authorised” user accesses the system.

&nbsp;And lastly, third-party applications that have been provided authorised access of CoWIN APIs can access personal level data of vaccinated people after OTP authentication.

The government claimed that without an OTP, data cannot be shared with the Telegram bot.

The ministry further pointed out that CoWIN only collects their year of birth while there is no provision to save a person’s address on the platform.

“Security Measures are in place on the Co-WIN portal, with Web Application Firewall, Anti-DDoS, SSL/TLS, regular vulnerability assessment, Identity &amp; Access Management, etc,” it said in a statement.

The health ministry further said that it has roped in the Indian Computer Emergency Response Team (CERT-In)—the Indian nodal government agency that looks after cyber security—to look into this issue and submit a report. In addition, an internal exercise has been initiated to review the existing security measures of CoWIN.&nbsp;

However, minutes later the Minister of Electronics and Technology, Rajeev Chandrasekhar, released a statement via Twitter that an initial investigation had already indicated that there had been a previous instance of CoWin data leak.

&nbsp;"A Telegram Bot was throwing up Cowin app details upon entry of phone numbers. The data was being accessed by bot from a threat actor database, which seems to have been populated with previously stolen data," he said.

Experts have noted that the CoWIN breach controversy warrants an urgent need for a data protection bill that will protect citizens from such exposure and ensure the accountability of institutions.

<h2>What is a bot?</h2>

A bot, short for robot, is a software application programmed to perform tasks through Robotic Process Automation, or RPA. Bots work by automatically going through a set of instructions, and they carry out tasks and processes much faster, more accurately, and at a higher volume than it would otherwise take humans.

On Telegram, every bot has a unique handle. To add a bot, one has to simply search for it, click on the bot handle and they will be able to interact with it in the chat window.

These bots can support "any kind of task or service," with some popular functions including delivering answers to users' FAQs, converting certain file types into others, or setting reminders for users.

However, of late, there has been sharp in increase of mishandling bots and primarily used to run scams, or exfiltrate personal data.

<h2>Can a bot threaten privacy of users?</h2>

Apparently yes, One of the main concerns raised&nbsp;about chatbots is the collection of personal information. Many chatbots collect user data, including their conversations, personal preferences, and location. Though this data is used used to personalise the chatbot responses and improve the user experience, there have been many instances where it is used for scams and identity thefts, spread malware and launch cyberattacks.

<h2>Has this happened before?</h2>

Twice there have been claims of CoWIN breach. The first instance was in June 2021, where a few had claimed the portal had been hacked resulting in the sale of data relating to 150 million Indians. The Indian government denied that this had happened.

Then in January last year, when similar reports of a data breach emerged, the chief of the National Health Authority, Ram Sewak Sharma, responded saying the database was "safe and secure".

<h2>What is CoWIN and how does it work?</h2>

CoWIN, which stands for COVID-19 Vaccine Intelligence Network, is an app introduced and made under the aegis of the central government for the vaccination process.

Also read |&nbsp;<a href="https://www.wionews.com/india-news/major-data-breach-in-india-personal-info-of-covid-vaccine-recipients-leaked-on-telegram-say-reports-603379">CoWIN leak: Indian govt refutes Covid vaccine portal data breach reports, orders probe</a>

It serves various services like registration, beneficiary tracking, appointment scheduling, vaccine stock management, real-time data monitoring, identity verification, vaccination, and issuing an instant digital certificate to each vaccinated individual.&nbsp;

CoWIN has so far recorded more than 2.2 billion administered vaccine doses through 5,773 vaccination sites.

(With inputs from agencies)

WATCH WION LIVE HERE

<iframe allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen="" frameborder="0" height="350" src="https://www.wionews.com/live-tv/embed?autoplay=1&amp;mute=1" width="100%"></iframe>

On Monday, several Indian media reported that India’s COVID-19 vaccine booking portal, CoWIN, was compromised, and sensitive personal information of thousands of users was leaked on the Telegram social messaging app.

On Monday, several Indian media reported that India’s COVID-19 vaccine booking portal, CoWIN, was compromised, and sensitive personal information of thousands of users was leaked on the Telegram social messaging app. It was claimed that a Telegram bot was revealing sensitive data of the users when inquired about an individual’s phone number. The bot leaked the name, Aadhaar number, PAN number, passport number, date of birth, location, gender, and the institute from where they got vaccinated. Notably, a user had to save some of these details while registering for the CoWIN app. Millions of Indian users had signed up on CoWIN portal, launched on January 16, 2021, and have used it to book vaccination slots. The data includes more than 40 million children aged between 12-14 and over 37 million people over the age of 45, a significant part of which could be senior citizens. Now, it is no longer possible to access this bot. Indian government’s response There were two, slightly different, reactions from the government. The first one was issued by the Indian health ministry which outrightly rejected claims of data leak saying that "all such reports are without any basis and mischievous in nature". In a press release, the health ministry said that there are three ways in which data on CoWIN can be accessed. First, a user can access their data on the portal through a one-time password (OTP) sent to their mobile number. Two, a vaccinator can access the data of a person, and the CoWIN system tracks and records each time an “authorised” user accesses the system. And lastly, third-party applications that have been provided authorised access of CoWIN APIs can access personal level data of vaccinated people after OTP authentication. The government claimed that without an OTP, data cannot be shared with the Telegram bot. The ministry further pointed out that CoWIN only collects their year of birth while there is no provision to save a person’s address on the platform. “Security Measures are in place on the Co-WIN portal, with Web Application Firewall, Anti-DDoS, SSL/TLS, regular vulnerability assessment, Identity & Access Management, etc,” it said in a statement. The health ministry further said that it has roped in the Indian Computer Emergency Response Team (CERT-In)—the Indian nodal government agency that looks after cyber security—to look into this issue and submit a report. In addition, an internal exercise has been initiated to review the existing security measures of CoWIN. However, minutes later the Minister of Electronics and Technology, Rajeev Chandrasekhar, released a statement via Twitter that an initial investigation had already indicated that there had been a previous instance of CoWin data leak. "A Telegram Bot was throwing up Cowin app details upon entry of phone numbers. The data was being accessed by bot from a threat actor database, which seems to have been populated with previously stolen data," he said. Experts have noted that the CoWIN breach controversy warrants an urgent need for a data protection bill that will protect citizens from such exposure and ensure the accountability of institutions. What is a bot? A bot, short for robot, is a software application programmed to perform tasks through Robotic Process Automation, or RPA. Bots work by automatically going through a set of instructions, and they carry out tasks and processes much faster, more accurately, and at a higher volume than it would otherwise take humans. On Telegram, every bot has a unique handle. To add a bot, one has to simply search for it, click on the bot handle and they will be able to interact with it in the chat window. These bots can support "any kind of task or service," with some popular functions including delivering answers to users' FAQs, converting certain file types into others, or setting reminders for users. However, of late, there has been sharp in increase of mishandling bots and primarily used to run scams, or exfiltrate personal data. Can a bot threaten privacy of users? Apparently yes, One of the main concerns raised about chatbots is the collection of personal information. Many chatbots collect user data, including their conversations, personal preferences, and location. Though this data is used used to personalise the chatbot responses and improve the user experience, there have been many instances where it is used for scams and identity thefts, spread malware and launch cyberattacks. Has this happened before? Twice there have been claims of CoWIN breach. The first instance was in June 2021, where a few had claimed the portal had been hacked resulting in the sale of data relating to 150 million Indians. The Indian government denied that this had happened. Then in January last year, when similar reports of a data breach emerged, the chief of the National Health Authority, Ram Sewak Sharma, responded saying the database was "safe and secure". What is CoWIN and how does it work? CoWIN, which stands for COVID-19 Vaccine Intelligence Network, is an app introduced and made under the aegis of the central government for the vaccination process. Also read | CoWIN leak: Indian govt refutes Covid vaccine portal data breach reports, orders probe It serves various services like registration, beneficiary tracking, appointment scheduling, vaccine stock management, real-time data monitoring, identity verification, vaccination, and issuing an instant digital certificate to each vaccinated individual. CoWIN has so far recorded more than 2.2 billion administered vaccine doses through 5,773 vaccination sites. (With inputs from agencies) WATCH WION LIVE HERE

Explained: CoWIN data leak, and how bots stoke privacy tensions

The Indian government refuted media reports of a major data breach in the Covid vaccination portal CoWIN. Issuing a statement,<a href="https://pib.gov.in/PressReleasePage.aspx?PRID=1931691"> the Union Health Ministry</a> said, "These reports allege a breach of data from the Co-WIN portal of the Union Health Ministry, which is the repository of all data of beneficiaries who have been vaccinated against Covid."

“Certain posts on the social media platform Twitter have claimed using a Telegram (online messenger application) BOT, the personal data of individuals who have been vaccinated is being accessed. It is reported that the BOT has been able to pull individual data by simply passing the mobile number or Aadhaar number of a beneficiary,” the statement said.&nbsp;

The ministry asserted that such reports are without any basis and are mischievous.&nbsp;

“Co-WIN portal of the Health Ministry is completely safe with adequate safeguards for data privacy. Furthermore, security measures are in place on the Co-WIN portal, with Web Application Firewall, Anti-DDoS, SSL/TLS, regular vulnerability assessment, Identity &amp; Access Management etc. Only OTP authentication-based access of data is provided,” the statement further said.&nbsp;

The ministry also said that without a One-Time-Password (OTP), vaccinated beneficiaries’ data cannot be shared with any BOT.&nbsp;

The health ministry also requested the Indian Computer Emergency Response Team (CERT-In) to look into this issue and submit a report. In addition, an internal exercise has been initiated to review the existing security measures of CoWIN.&nbsp;

CERT-In in its initial report has pointed out that the backend database for the Telegram bot was not directly accessing the APIs of the CoWIN database.&nbsp;

<h2>What did the reports say?</h2>

Earlier on Monday, a section of the Indian media reported&nbsp;that the personal details of those registered to CoWIN&nbsp;were available on the messaging platform Telegram. According to a report by The News Minute, a Telegram bot had&nbsp;been giving away the details of people who registered for vaccination including their names, date of birth, phone numbers, and other details provided at the time of registration, such as passport or Aadhar numbers among others.&nbsp;

As per a report by Kerala-based Malayala Manorama, if the mobile number of a person was entered, the above details were provided as a reply in an instant by Telegram. The details could be accessed even if the Aadhar number was entered instead of the mobile number, the report added.&nbsp;

Passport numbers of people who updated CoWIN&nbsp;for travelling abroad were leaked. The Manorama report also said that since&nbsp;many members of a family registered themselves on the portal under a single phone number, their details were also available on Telegram.&nbsp;

<h2>TMC’s Saket Gokhale alleges data breach of politicians, journalists</h2>

The data breach also leaked the details of many prominent politicians and journalists in India. In a Twitter thread, Trinamool Congress (TMC) leader Saket Gokhale shared screenshots of the details of politicians and journalists being leaked.&nbsp;

<div class="ui-state-default" contenteditable="false">
<div class="twitter-block" draggable="false">
<blockquote class="twitter-tweet">
SHOCKING: 
 
There has been a MAJOR data breach of Modi Govt where personal details of ALL vaccinated Indians including their mobile nos., Aadhaar numbers, Passport numbers, Voter ID, Details of family members etc. have been leaked &amp; are freely available. 
 
Some examples 👇 
 
(1/7)
— Saket Gokhale (@SaketGokhale) <a href="https://twitter.com/SaketGokhale/status/1668104757704269824?ref_src=twsrc%5Etfw">June 12, 2023</a></blockquote>
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script></div>
<a class="close-mark close-div" href="#" id="jqclosemark">×</a></div>

"There has been a MAJOR data breach of Modi Govt where personal details of ALL vaccinated Indians including their mobile nos., Aadhaar numbers, Passport numbers, Voter ID, Details of family members etc. have been leaked &amp; are freely available," Gokhale tweeted and slammed the central government of not being aware of the leak and not informing citizens about the same.&nbsp;

"Who has the Modi Govt given access to sensitive personal data of Indians incl Aadhaar &amp; Passport nos. which enabled this leak?" the TMC leader added and called the breach "a matter of serious national concern."

WATCH WION LIVE HERE

<iframe allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen="" frameborder="0" height="350" loading="”lazy”" src="https://www.wionews.com/live-tv/embed?autoplay=1&amp;mute=1" width="100%"></iframe>

You can now write for wionews.com and be a part of the community. Share your stories and opinions with us <a href="https://www.wionews.com/content-contribution-registration-form">here</a>.

The Indian government refuted media reports of a major data breach in the Covid vaccination portal CoWIN. Issuing a statement, the Union Health Ministry said, "These reports allege a breach of data from the Co-WIN portal of the Union Health Ministry, which is the repository of all data of beneficiaries who have been vaccinated against Covid.

The Indian government refuted media reports of a major data breach in the Covid vaccination portal CoWIN. Issuing a statement, the Union Health Ministry said, "These reports allege a breach of data from the Co-WIN portal of the Union Health Ministry, which is the repository of all data of beneficiaries who have been vaccinated against Covid." “Certain posts on the social media platform Twitter have claimed using a Telegram (online messenger application) BOT, the personal data of individuals who have been vaccinated is being accessed. It is reported that the BOT has been able to pull individual data by simply passing the mobile number or Aadhaar number of a beneficiary,” the statement said. The ministry asserted that such reports are without any basis and are mischievous. “Co-WIN portal of the Health Ministry is completely safe with adequate safeguards for data privacy. Furthermore, security measures are in place on the Co-WIN portal, with Web Application Firewall, Anti-DDoS, SSL/TLS, regular vulnerability assessment, Identity & Access Management etc. Only OTP authentication-based access of data is provided,” the statement further said. The ministry also said that without a One-Time-Password (OTP), vaccinated beneficiaries’ data cannot be shared with any BOT. The health ministry also requested the Indian Computer Emergency Response Team (CERT-In) to look into this issue and submit a report. In addition, an internal exercise has been initiated to review the existing security measures of CoWIN. CERT-In in its initial report has pointed out that the backend database for the Telegram bot was not directly accessing the APIs of the CoWIN database. What did the reports say? Earlier on Monday, a section of the Indian media reported that the personal details of those registered to CoWIN were available on the messaging platform Telegram. According to a report by The News Minute, a Telegram bot had been giving away the details of people who registered for vaccination including their names, date of birth, phone numbers, and other details provided at the time of registration, such as passport or Aadhar numbers among others. As per a report by Kerala-based Malayala Manorama, if the mobile number of a person was entered, the above details were provided as a reply in an instant by Telegram. The details could be accessed even if the Aadhar number was entered instead of the mobile number, the report added. Passport numbers of people who updated CoWIN for travelling abroad were leaked. The Manorama report also said that since many members of a family registered themselves on the portal under a single phone number, their details were also available on Telegram. TMC’s Saket Gokhale alleges data breach of politicians, journalists The data breach also leaked the details of many prominent politicians and journalists in India. In a Twitter thread, Trinamool Congress (TMC) leader Saket Gokhale shared screenshots of the details of politicians and journalists being leaked. SHOCKING: There has been a MAJOR data breach of Modi Govt where personal details of ALL vaccinated Indians including their mobile nos., Aadhaar numbers, Passport numbers, Voter ID, Details of family members etc. have been leaked & are freely available. Some examples 👇 (1/7) — Saket Gokhale (@SaketGokhale) June 12, 2023 × "There has been a MAJOR data breach of Modi Govt where personal details of ALL vaccinated Indians including their mobile nos., Aadhaar numbers, Passport numbers, Voter ID, Details of family members etc. have been leaked & are freely available," Gokhale tweeted and slammed the central government of not being aware of the leak and not informing citizens about the same. "Who has the Modi Govt given access to sensitive personal data of Indians incl Aadhaar & Passport nos. which enabled this leak?" the TMC leader added and called the breach "a matter of serious national concern." WATCH WION LIVE HERE You can now write for wionews.com and be a part of the community. Share your stories and opinions with us here.

CoWIN leak: Indian govt refutes Covid vaccine portal data breach reports, orders probe

cowin-leak

Cowin Leak, News on Cowin Leak, stories on Cowin Leak, articles on Cowin Leak, Cowin Leak stories at Wion, Cowin Leak news, Cowin Leak latest news

cowin leak

Explained: CoWIN data leak, and how bots stoke privacy tensions

CoWIN leak: Indian govt refutes Covid vaccine portal data breach reports, orders probe