Thread by @logic

TN PDS defaced (and data breached?) theweek.in/news/india/202…

- @nanduhari of @technisanct

https://twitter.com/sindhan/status/1408708995150278660

The site was under 'maintenance' on Jun 27. Tweet report by DMK IT Wing person.

https://twitter.com/Sathish33403113/status/1409020663172579328?s=20

5M records put on #RaidForums for sale, later taken down.

https://twitter.com/Pravinkks/status/1409566402730610692

dinamalar.com/news_detail.as… ரேஷன் கார்டு இணையதளம் பராமரிப்புக்காக நிறுத்தம் - @dinamalarweb noting the site tnpds.gov.in was down for maintenance and upgrade. #Okay

tamil.news18.com/news/tamil-nad… News18 Impact: ரேஷன் கார்டு தரவுகள் திருட்டு... தனிப்படை அமைத்து அரசு விசாரணை

Report says TN government constituted special team to carry out a cyber investigation on the incident.

The timing of this incident is extremely worrisome. This happened 2 days before #SFDB bid opened (yesterday, 29 June) Read more on #SFDB, designed to be built on top of ration db, junking #Aadhaar. 👇🏾

https://twitter.com/logic/status/1392093560456028165

medianama.com/2021/06/223-ta… Tamil Nadu PDS System Breached, 50 Lakh People’s Aadhaar Details Leaked: Report via @medianama

The TN PDS infra was already suspectible to what looks like bunch of fake / illicit apps for accessing the site - having embedded trojan / virus in them.

The now deleted thread on #raidforums posted by raidforums.com/User-Mr-JohnCr…

Was there a buyer?

dtnext.in/News/TamilNadu… The breach is reported to @IndianCERT . But have they ever carried out incidents to conclusion ?

After what is possibly largest international cyber attack on #PDS infrastructure, TN government *restarts* biometric authentication at PDS shops. 🤦🏾‍♂️🤦🏾‍♂️🤦🏾‍♂️ cc @rozi_roti @roadscholarz

#ONORC forced biometric authentication in Universal #PDS state TN. 🤦🏾‍♂️🤦🏾‍♂️

https://twitter.com/mahi190796/status/1410145948186013696

The data is now being put to sale. Details here @chennaipolice_ @copmahesh1994 #Makkal #Aadhaar #SRDH #TNPDS 25M data leak for sale. HT @nanduhari

Post is now updated with 31M records. Looks like actor has active access to the server. This is heights on part of @OasysIndia to have denied the breach incident in their communication to state. cc @nanduhari

Cyber startup says Tamil Nadu’s PDS data breached
thehindu.com/news/national/… - The denial from Food and Consumer Affairs Department. @CMOTamilnadu - Please don't let officially lie and get away.

ரேசன்கார்டு தகவல்கள் கசிவு - தமிழ்நாட்டுக்கு கேரளா கொடுத்த எச்சரிக்கை - முழு விவரம் - A slightly detailed piece on how to take denials and why its risky. bbc.com/tamil/india-57…

Post updated again, 51M records now. Even if there is overlap, at least 20M 'unique' individuals were compromised if one were to trust the leak post.

The leak also demostrates that #AadhaarVault is not all that secure. Because - by any definition, #TNPDS ought to have got certified for #AadhaarVault, as per current @UIDAI guidelines, how then did actor get access to raw #Aadhaar numbers ? cc @iam_anandv @anivar @baudless

#TNPDS again taken down for maintenance. Hopefully they do a thorough forensic audit before coming back online

This comes as the state government attempts to create a State Family Database for e-governance, and has sought for it to be the “single source of truth on all details with respect to the state’s residents”, thenewsminute.com/article/data-3… #SFDB #Aadhaar #DataP #SaveOurPrivacy

So @CMOTamilnadu had a meeting with secretaries including Chief Secretary. Hopefully they did discuss the breach and the press note is just public statement.

https://twitter.com/MRK_POLLACHI/status/1411243328494964736

Talking about #TNPDS Ration card, #Aadhaar, #MakkalNumber leak and the site defacement at 7 PM today in @TamilSpaces hosted by @SuryaCEG Tune in to know what has happened and how it impacts you.

https://twitter.com/SuryaCEG/status/1411560411434950662

Notes about vendor. We will come back soon with some incriminating details about the leak. Keep denying till then @OasysIndia , It will help if you post your denials publicly.

The actor, meanwhile has updated pricing. $900 for 4 files, exposing 2 Crore #Aadhaar and 5.1 Crore records in all.

900$ - translates to 0.3 paisa per individuals' #Aadhaar. Take that. cc @internetfreedom @SFLCin @nixxin #TNPDS

OASYS is catering to nearly 24 crore citizens of rural and urban India. A breach in OASYS managed infra is not limited to Tamilnadu. cc @internetfreedom @SFLCin @nixxin

This is also evidenced in the 640K #Aadhaar shared as proof by User JohnCrypt on raidforums.

$500 now. This strangely looks like.

"Tempo laam vechu kadathirukkom saar, pathu pottu kodunga."

Hacker : Paid for bandwidth etc, man, please give me something.

Sample files of 15k #Makkal Number and 10k #Aadhaar is available now publicly.

Did you know #MakkalNumber is a 8 character alphabetic code is not a 'number' ? #Makkal also tracks death, unlike #Aadhaar.