A woman goes through the process of finger scanning for Aadhaar, at a registration centre in New Delhi. REUTERS/Saumya KhandelwalNew Delhi: India's biometric ID programme, Aadhaar, has been hit by another major security lapse, allowing access to private information, business technology news website ZDNet reported on Saturday.
A data leak on a system run by a state-owned utility company can allow access to private information of Aadhaar holders, exposing their names, their unique 12-digit identity numbers, and their bank details, ZDNet said.
Even though the security lapse had been flagged to some government agencies over a period of time, it has yet to be fixed. ZDNet said it was withholding the name of the utility and other details.
Karan Saini, a New Delhi-based security researcher, said that anyone with an Aadhaar number was affected.
"This is a security lapse. You don't have to be a consumer to access these details. You just need the Uniform Resource Locator where the Application Programming Interface is located. These can be found in less than 20 minutes," Saini told Reuters.
UIDAI says its database safe
The Unique Identification Authority of India (UIDAI) on Saturday refuted the reports about a fresh data leak of Aadhaar holders, and asserted that there has been "absolutely no breach" of its database.
Women stand in a queue to get themselves enrolled for Aadhaar. REUTERS/Mansi ThapliyalIn a statement issued, UIDAI, the Aadhaar-issuing body, said:"there is no truth in this story as there has been absolutely no breach of UIDAIs Aadhaar database. Aadhaar remains safe and secure".
It termed the data breach claims as "totally baseless, false and irresponsible".
The UIDAI has argued that even if the report claims were taken to be true, the security related concerns should be around the database of utility company in question. It has "nothing to do with security of UIDAIs Aadhaar database", it said.
Going by the logic of the report, since the utility company's database also had bank account numbers of its customers, would bank databases also be considered to have been breached, UIDAI questioned.
"The answer would obviously be in negative," it added.
UIDAI argued that mere availability of Aadhaar number with a third person "will not be a security threat to the Aadhaar holder" nor will it lead to financial or other fraud. This is because a transaction is contingent upon a successful authentication through fingerprint, Iris or OTP of the Aadhaar holder, UIDAI said.
Aadhaar, a biometric identification card with over 1.1 billion users, is the world's biggest database.
But it has been facing increased scrutiny over privacy concerns following several instances of breaches and misuse.
Last Thursday, the CEO of the UIDAI said the biometric data attached to each Aadhaar was safe from hacking as the storage facility was not connected to the Internet.
"Each Aadhaar biometric is encrypted by a 2048-key combination and to decode it, the best and fastest computer of our era will take the age of the universe just to hack into one card's biometric details," Ajay Bhushan Pandey said.
(With inputs from Reuters and PTI)
Read: Latest India News
