Key Points:
- The IRCTC’s Data of 90,000 plus people has been leaked through the app.
- The data is visible on the Dark Web.
- The details that have leaked include full names, phone numbers, marital status, and more.
- IRCTC said that the data seems old and can be a part of the leak that happened 5 years back.
- IRCTC App and Tejas Express link users must be aware.
A set of user data belonging to more than 900,000 users has been seen on the dark web. The data was seen by a dark web risk monitoring firm called Cyble.
- Cyble came across the post where a user allegedly claimed that user of data of close to one million people.
- The data is said to be leaked sometime in 2019.
- The data was shared on the Dark Web on October 13.
- Cyble found that the data belonged to IRCTC which is a subsidiary of Indian Railways that deals with online ticketing, catering and other tourism operations.
- The information of each user includes: Full Name, Mobile Phone Number, Date of Birth, Gender, Marital Status, City of Origin and State.
#FYI | "IRCTC is partially right. The data that is available on the dark web now is not a new breach. It happened almost 5 years ago. Somebody is reselling that data now": Jiten Jain, cybersecurity expert pic.twitter.com/GC8AeAMd5a
— NDTV (@ndtv) October 16, 2020
The data that has been shared hasn’t been asked for any fee by the user. The IRCTC also, has not received any ransom note or extorted. Therefore, it seems the user that shared the data didn’t exfiltrate it.
IRCTC Spokesperson and PRO Siddharth Singh told NDTV that no user data has been leaked recently and the data that appeared on the Dark Web seems to be of a very general nature and something that’s available even on e-commerce portals.
IRCTC clarified that this data seems to be old and a part of a breach that happened 5 years ago.
Safety Measures:
- Check Cyble’s AmIBreached.com tool to figure out if your name is included in this leak.
- If yes, be careful will the SMS and calls you might receive.
- Get your recent bank transactions checked.
- If any unknown transactions are seen, immediately contact the bank.
