A security lapse exposed India’s CISF personnel files and health records
Internal documents, officer health records, and personnel files belonging to India’s Central Industrial Security Force were spilling online because of a data security lapse.
A security researcher in India, who asked not to be named for fear of retaliation from the Indian government, found a database packed with network logs generated by a security appliance connected to CISF’s network. But the database was not secured with a password, allowing anyone on the internet to access the logs from their web browser.
The network logs contain detailed records of which files on CISF’s network were accessed or blocked because of security rules. Because the logs contained full web addresses of documents stored on CISF’s network, it was possible for anyone on the internet to access the logs, and then open those files in their browser directly from CISF’s network, also without needing a password.
The logs contained records for more than 246,000 full web addresses of PDF documents on CISF’s network, many of which relate to personnel files and health records, and contain personally identifiable information on CISF officers. Some of the files are dated as recently as 2022.
CISF is one of the largest police forces in the world with more than 160,000 personnel, tasked with protecting government facilities, infrastructure, and airport security across the country.
The researcher said the security appliance is built by Haltdos, an India-based security company that provides network security technology to organizations. The database was first found to be exposed on March 6, according to Shodan, a search engine for exposed devices and databases. TechCrunch confirmed that the database was configured with the name “haltdos.”
Haltdos CEO Anshul Saxena did not respond to multiple requests for comment. TechCrunch also emailed a CISF public affairs officer with several web addresses of publicly exposed files stored on its servers, but we did not receive a response. It’s not uncommon for government organizations in India to quietly fix security issues when alerted by good-faith security researchers but then rebuff or deny the claims when they invariably become public knowledge.
The database is no longer accessible, though the security appliance itself appears to still be online.
- This alien-like speaker concept is perfect for your PC gaming rig
- Don’t buy a breach or a bad reputation: A more effective approach to M&A due diligence
- Knork Eco Party Plate makes sustainable partying a possibility
- Tech CEOs to face faster criminal liability under UK online safety law
- This hand-cranked screwdriver’s mechanical action is the most satisfying thing you’ll see today
- Indonesian earned wage access platform Wagely raises $8.3M as it expands into Bangladesh