Thread by @anivar

The Fourth yesterday reported about a huge #CoWinDataLeak yesterday. There was a telegram Not which allowed to search against phone numbers or aadhaar for vaccine data. Exposed details includes

Family details(who took vaccination under the same number) and below fields

This is potentially one among the largest data leaks so far and looks like everyone who took vaccination via #Cowin is part of this database. They could verify many in this DB

@b_sreejan from The Fourth done a thread here

https://twitter.com/b_sreejan/status/1668068417239396352?s=46&t=PV6PS7ZWD6zPJktTrBlhuw

Today @Onmanorama covers this as front page lead story , after independently verifying the same. They also carry information hidden in the screenshot of health secretary Rajesh Bhushan and family

Thread by @Onmanorama reporter @Jikkuvarghese here.

The magnitude of this data leak is so big and it contains identity data of almost all who trusted system to get vaccination including me. Possibly this might be only such data set with family expose

https://twitter.com/Jikkuvarghese/status/1668080933969498112

I like to point out there was significant outcry by myself in tweet threads , many civil society organizations and individuals to ensure privacy of Indian citizens in vaccination. Most of them got ignored and data security seems to be neglected totally

https://twitter.com/anivar/status/1381823055119314944

There was news on #CowinDataleak in 2021 June too but that later got denied by some cyber security experts. Is this from same leak or new ? No idea

ciso.economictimes.indiatimes.com/news/cowin-not…

Similarly we have seen claims like this from @rssharma3 when another #CoWinDataLeak news came up . but now there is a leak double verified by 2 independent news outlets including his vaccination data

https://twitter.com/rssharma3/status/1484584060697845763?t=D55PbNlYS7mPUIAQHe4Btg&s=09

Remember , this is one Telegram bot someone built using that data set. Many copies of data must be out there .

If all Indians took vaccination, this is a 1.4 billion database exposing Aadhaar/ voterID/passport , date of birth , phone number , vaccination center with family .

And this is the leaky tech India sharing as Digital Public Infrastructure to poor countries. @UNDP @UNDP_India you should look at this information and analyze.

Privacy risks on the same is highlighted by many in 2021 itself
Samples @TheKenWeb @no2uid @SFLCin @internetfreedom

Thread by @logic on impacts

https://twitter.com/logic/status/1668092854898659331?t=k8YGc0Eh6W-9JcOqnS52HA&s=19

The database is after 2022.

https://twitter.com/logic/status/1668096339710984193?t=_Qup14SEWnXWviAp7pr-kw&s=19

The deactivated aadhaar of Lord Hanuman got 5+ vaccinations.

Same with deactivated aadhaar of Pakistani Spy

https://twitter.com/logic/status/1668100223737143298?t=mbTpZ7crIriJsojdda3GxQ&s=19

@SaketGokhale has another thread on same

https://twitter.com/SaketGokhale/status/1668104757704269824?t=s32_0xWF1vsYrQn_B85mrQ&s=19

Here is the Video proof of the leak data.

From @thefourthlive 's first report

The list includes every indians who got vaccinations. @SaketGokhale lusts some among them on his tweets

Polititions Journalists top leaders

No one is exempted

https://twitter.com/SaketGokhale/status/1668104759872733186?s=19

@thenewsminute also independently verified by checking details of TN political leaders

That makes it 3 media house verification on #DPIDisaster

https://twitter.com/anivar/status/1668147899975491586

And Remember this cartoon from @WorldOfHalahala ?
@rssharma3 proves HARM is in his middle name affects all Indians in every system he built with @NandanNilekani

Porous Digital Infrastructure they built compromised the data security of a generation

https://twitter.com/jackerhack/status/1338361864657326082?s=20

A journo asked what I demand?

I am not demanding anything. I am just sad seeing all this data compromise. When CoWin is building, we tried to warn and correct all for one purpose. Better data security and privacy along with Access to Vaccination. Now this is irreversible

But as a country, instead of learning from mistakes, we delay our Data protection law, State demands blanket trust with user data, while they are incapable to handle it, bringing more and more centralization systems without taking responsibility. This needs an accountability fix.