India’s government is currently investigating reports of a data breach involving personal data from the country’s Covid-19 vaccination portal which is accessible to anyone who received a vaccine in India. Reports indicate that a bot on the encrypted messaging app Telegram was downloading data from the government’s CoWIN vaccine portal which included sensitive information such as social security numbers, passport numbers, and dates of birth. This leak puts the data privacy of more than one billion Indian citizens who have been vaccinated at risk.
While acknowledging the reports of the data breach, India's Health Ministry has claimed that the portal is "completely safe with adequate safeguards for data privacy" and described the reports as baseless and mischievous. Meanwhile, Telegram has confirmed that it has taken down the bot which was being used to leak the data.
This is not the first time that the CoWIN portal has been hacked. In January last year, news reports claimed that data belonging to around 20,000 people had been leaked onto online marketplace forums. The Indian government denied these allegations.
According to Divyanshu Jindal, a New Delhi-based researcher, the timing of the current incident is significant, given Prime Minister Narendra Modi’s upcoming official state visit to the US. He believes that the India-US tech partnership is a crucial focus of the visit, and the India Stack has been widely praised for showcasing India’s digital capabilities in this regard. The India Stack is an infrastructure designed to bring India’s entire population into the digital age.