LPG Gas Company Leaked Details, Aadhaar Numbers of 6.7 Million Indian Customers

Why would someone bother to hack a so-called “ultra-secure
encrypted database that is being protected behind 13 feet high and
5 feet thick walls,” when one can simply fetch a copy of the same
data from other sources.

French security researcher Baptiste Robert, who goes by the
pseudonym “Elliot Alderson” on Twitter, with the help of an Indian
researcher, who wants to remain anonymous, discovered that the
official website of popular state-owned LPG gas company Indane is
leaking personal details of its millions of customers, including
their Aadhaar numbers.

This is not the first time when an unprotected third-party
database has leaked Aadhaar details of Indian citizens, which is a
unique number assigned to each citizen as part of India’s biometric
identity programme maintained by the government’s Unique
Identification Authority of India (UIDAI).

Earlier this week an anonymous Indian researcher initially
discovered a loophole in the Indane’s online dealers portal that
could allow anyone to access hundreds of thousands of customers
data associated with their respective dealers without requiring any
authentication.

To avoid getting into trouble from Indian authorities, the
researcher shared his findings with Robert, who previously gained
fame for exposing numerous Aadhaar-related leaks and security
weaknesses in other Indian website and services.

After analyzing the issue, Robert discovered that attackers
can actually fetch millions of Indian citizens data from the Indane
website if they know every dealer’s username, which he later found
using another vulnerability in the Indane’s official mobile
app.
The mobile app vulnerability allowed Robert to find 11,062 valid
dealer IDs, out of which he used 9490 IDs against the online
dealers portal to fetch personal data of 5.8 million users,
including their Aadhaar numbers, names and residential addresses.

Robert shared his findings with Indane, an LPG brand owned by the
Indian Oil Corporation, on 15th February, and made the public
disclosure on 19th February after receiving no response from the
company.