New Delhi sources stated that a French researcher has claimed that he found a security lapse that allegedly exposed millions of Aadhaar numbers of dealers and distributors associated with Indane, an LPG brand owned by the Indian Oil Corporation (IOC). Reportedly Baptiste Robert, who goes by the online handle Elliot Alderson and has exposed Aadhaar leaks in the past, wrote in a blog post on Medium late Monday that the Aadhaar data of nearly 6.7 million dealers and distributors of Indane, accessible only with a valid username and password, was left exposed.
Alderson said "Due to a lack of authentication in the local dealer’s portal, Indane is leaking the names, addresses and the Aadhaar numbers of their customers”. Furthermore using a custom built script to scrape the database, Alderson found customer data for nearly 11,000 dealers, including names and addresses of customers, before his IP was blocked by Indane. He said "I wrote the python script”.
Moreover the French researchers found 5.8 million Indane customer records before his script was blocked. "Unfortunately, Indane probably blocked my IP, so I didn't test the remaining 1,572 dealers. Apparently by doing some basic math we can estimate the final number of affected customers around 6,791,200". Indane and the Unique Identification Authority of India (UIDAI) were yet to comment on this data leak.
