The World’s Largest Biometric Digital ID System, India’s Aadhaar, Just Suffered Its Biggest Ever Data Breach

In one fell swoop, roughly 10% of the global population appears to have had some of their most valuable personal identifiable information (PII) compromised. Yet Aadhaar continues to receive plaudits from Silicon Valley. 

An anonymous hacker claims to have breached the digital ID numbers, as well as other sensitive personal data, of around 815 million Indian citizens. To put that number in perspective, it is more than 60% of the 1.3 billion Indian people enrolled in the government’s Aadhaar biometric digital identity program, and roughly 10% of the entire global population. Thanks to the breach — the largest single one in the country’s history, according to the Hindustan Times — the personal data of hundreds of millions of Indians are now up for grabs on the dark web, for as little as $80,000.

To register for an Aadhaar card, Indian residents have to provide basic demographic information, including name, date of birth, age, address and gender, as well as biometric information, including ten fingerprints, two eyeball scans and a facial photograph. Much of that data has apparently been compromised.

Media reports suggest that the source of the leak was the Covid-19 test data of the Indian Council of Medical Research (ICMR), which is linked to each individual’s Aadhaar number. The alarm was first raised by Resecurity, a Los Angeles-based cyber security company, which on Oct 15 included the following in a blogpost on its corporate website:

On October 9th, a threat actor going by the alias ‘pwn0001’ posted a thread on Breach Forums brokering access to 815 million “Indian Citizen Aadhaar & Passport” records. To put this victim group in perspective, India’s entire population is just over 1.486 billion people.

HUNTER investigators established contact with the threat actor and learned they were willing to sell the entire Aadhaar and Indian passport dataset for $80,000.

The data set offered by pwn0001 contains multiple fields related to the PII of Indian citizens, including but not limited to:

– name
– father’s Name
– phone Number
– other Number
– passport Number
– aadhar Number
– age
– gender
– address
– district
– pincode
– state…

One of the leaked samples contains 100,000 records of personal identifiable information (PII) related to Indian residents. In this sample leak, HUNTER analysts identified valid Aadhaar Card IDs, which were corroborated via a government portal that provides a “Verify Aadhaar” feature. This feature allows people to validate the authenticity of Aadhaar credentials,” Resecurity said…

Resecurity acquired… 400,000 records and contacted multiple victims to validate the information, as well as used the “Verify Aadhaar” feature available via official government WEB-resource in India.

The contacted victims from the acquired data set confirmed the validity of their data, and stated they have never been notified about [the breach] before.

Digital Identity Theft

A leak of such highly sensitive personal identifiable information (PII) creates a significant risk of digital identity theft, warns Security Affairs:

Threat actors leverage stolen identity information to commit online banking theft, tax refund fraud, and other cyber-enabled financial crimes. Nation-state actors are also hunting for Aadhaar data with the goal of espionage and influence campaigns that leverage detailed insights on the Indian population. Resecurity observed a spike in incidents involving Aadhaar IDs and their leakage on underground cybercriminal forums by threat actors who look to harm Indian nationals and residents.

Aadhaar (Hindi for “foundation”) is a 12-digit unique identity (UID) number issued by the government after confirming a person’s biometric and demographic information. Launched in 2012 as part of an initiative to give each Indian resident with a unique identification number, it is the largest digital identity system on the planet, with 1.3 billion UIDs issued by 2021, covering a staggering 92% of India’s population.

It was ostensibly created to provide people without identification a formal government ID as well as crack down on duplicate, fake or stolen IDs used to benefit from government programs and welfare schemes. And it quickly drew interest and praise from elite quarters around the world, including Silicon Valley.

In a 2019 entry of his “Gates Notes” blog, Bill Gates lauded Aadhaar for making “India’s invisible people visible.” Three years earlier, in a lecture on Technology for Transformation, Gates had said that Aadhaar is something that had never been done before by any government, not even in a rich country. He also claimed it does not pose any privacy risks; try telling that to the 815 million people whose personal data is now up for grabs on the Dark Web!

Together with Nandan Nilekani, one of the co-founders of Indian tech giant Infosys who is widely recognised as Aadhaar’s chief architect, Gates went on to play a key role in exporting Aadhaar to other parts of the so-called Global South, much of it financed by the World Bank. The two tech billionaires also reportedly helped persuade the Modi government to embark on the disastrous path of demonetisation in order to expand cashless payment alternatives. Demonetisation is believed to have caused a 2% drop in India’s GDP growth in 2016/17 alone — the equivalent of $52 billion, according to the Sunday Guardian.

Even today, Aadhaar continues to receive plaudits from Silicon Valley, despite all of its security flaws, privacy concerns and other issues. Worldcoin, the controversial cryptocurrency project set up by OpenAI CEO Sam Altman that uses an eye-scanning “orb” to give users a unique digital identity to verify whether they are human, recently said it seeks to emulate India’s Aadhaar system in its own creation of a global identity and financial network.

Ironically, both Aadhaar and World Coin were featured in a recent report by Moody’s Investor Services as examples of how not to develop a digital identity system. As I noted at the time, it is not clear whether Moody’s criticisms were merely poorly timed, given the geopolitical backdrop, or form part of a broader campaign in the Anglosphere against India’s interests. The Modi government and Indian tech businesses are desperately keen to export the so-called “Indian Stack” — the Jan Dhan Yojana, a financial inclusion program; UPI, an instant payments system launched in 2016, just six months before the government yanked 84% of India’s cash notes out of circulation in its infamous demonetisation campaign; and Aadhaar.

Mission Creep on Steroids

Aadhaar was first introduced as a voluntary way of improving welfare service delivery. But the Modi government rapidly expanded its scope by making it mandatory for welfare programs and state benefits.

The mission creep didn’t end there. Aadhaar has become all but necessary to access a growing list of private sector services, including medical records, bank accounts and pension payments. According to Security Affairs, it is the security weaknesses of many of these third parties, including utility companies, independent service providers, mobile and telecommunication operators, and lending and fintech services, that are behind many of the data breeches.

Plans are also afoot to link voter registration to Aadhaar, despite the system’s glaring security flaws. Besides the vulnerability of its data storage, India’s Aadhaar system has many other downsides, as I noted in my book Scanned:

For a start, it tracks users’ movements between cities, their employment status and purchasing records. It is a de facto social credit system that serves as the key entry point for accessing services in India. While the system has helped to speed and clean up India’s bureaucracy, it has also massively increased the Indian government’s surveillance powers and excluded over 100 million people from welfare programs as well as basic services.

The public body in charge of Aadhaar, the Unique Identification Authority of India (UIDAI), is yet to comment on the latest breach. But if past form is any guide, when it does it will deny all charges. It has so far refuted all accusations of data breaches, since the Aadhaar system went fully live seven years ago, including claims from Wikileaks that the CIA might have access to the database and allegations in the World Economic Forum’s Global Risks Report 2019 that Aadhaar had “suffered multiple breaches that potentially compromised the records of all 1.1 billion registered citizens.”

Given the sheer number of breaches Aadhaar has suffered, this level of denialism is becoming untenable. Even Biometric Update, the most important trade publication for the biometrics industry, has warned that India is “bleeding biometric data.” And biometric data is our most valuable personal identifiable information. If it is hacked there is no way of undoing the damage. You cannot change or cancel your iris or fingerprint like you can change a password or cancel a credit card.

The chances of that data being hacked are significant given how pourous most databases are, notes Professor Sandra Watcher, a data ethics professor at the Oxford Internet Institute:

“The idea of a data breach is not a question of if, it’s a question of when. Welcome to the internet: everything is hackable.

Given the sheer number and scale of recent breaches,  the “Indian govt’s insistence that Aadhaar is secure rings hollow,” concludes Biometric Update:

A piece in Security Affairs reports that earlier this month, the cybersecurity firm Resecurity found hundreds of millions of records containing personally identifiable information (PII) for sale on the dark web. Aadhaar cards were among the data on offer.

Also in October, the PII of applicants to a program for young filmmakers at the International Film Festival of India was exposed on a government website for the event. The Deccan Herald reports that the Times of India was able to access a parent directory that contained the Aadhaar IDs, PAN cards and other PII of more than 100 people who applied through the National Film Development Corporation (NFDC).

Furthermore, as reported in The Hindu, a police raid on a brothel in Bengaluru found that sex workers had been given fake Aadhaar cards, and prompted an investigation into wider production of fake government IDs, voter cards and other documents.

And finally, there is the now-resolved case of fingerprint biometrics, digital ID numbers, identity documents, photographs and images submitted to Aadhaar being exposed by the West Bengal state government website.

The latter case is particularly pertinent since it reveals how fragile biometric identifiers can be, especially when it comes to finance. In recent years, a consortium of public and private sector players, including the Reserve Bank of India, UIDAI, the National Payments Corporation of India (NPCI) and the Institute for Development and Research in Banking Technology, has developed a cardless banking system called the Aadhaar-enabled Payment System, or AePS. To avail of the service, all customers need is a bank name, an Aadhaar number and the biometric identifiers captured during their Aadhaar enrolment. It’s quick, easy but not remotely safe.

A recent criminal case in Bengal has revealed that a purely biometric-enabled payment system, involving no cards and no PIN numbers, is not secure, particularly when the biometric identifiers in question and Aadhaar numbers are easily accessible on the World Wide Web. As always in these cases, enterprising fraudsters are leagues ahead of the authorities. From Business Standard:

The latest scam alert came to light after Kolkata Police uncovered cases where fraudsters are stealing data, including thumbprints, from land registries off the West Bengal Government’s land records website. Two individuals were reportedly arrested for their involvement in fraudulent transactions using the Aadhaar Enabled Payment System (AePS).

“These accused developed fake fingerprints that were used to withdraw money from the complainant’s bank account. Primarily. It has been found that the electronic data are gathered from different public domains/websites,” a senior officer of Kolkata Police told the Indian Express.

Subsequently, Kolkata Police requested the state Finance Department to conceal biometric data, including fingerprints, and Aadhaar card numbers extracted from property deeds or any other documents uploaded to the state government’s property registration website.

The response from certain banks and law enforcement agencies is revealing: they are telling bank customers to lock their biometrics at m-Aadhaar app/UIDAI portal and start using a four-digit pin to authenticate payments and prevent unauthorized access to their bank accounts. It is an open admission that biometric identifiers, on their own, are not safe enough for transaction purposes. Nor are they being stored securely by public or private entities. This should (but probably won’t) serve as a cautionary tale for all the other governments and companies around the world seeking to harness the power of biometric identifiers and digital identity.


Print Friendly, PDF & Email


  1. The Rev Kev

    I really regret not setting up a betting pool when they first brought in this system on how long it would take to have a major security problem occur. If you want to be blunt about it, Modi got all the honeypots of databases scattered around India and then put them all into one gigantic honey pot. I bet that hackers have been having goes at it for years now and you can never be sure that it might not have been an inside job. So instead of being a nation-wide secure system, the thing is now a sieve that will force people to add in their own layers of security such as using a four-digit pin to authenticate payments with. I don’t know if they can wind back the Aadhaar system or will have to add all sorts of new layers of authentication or not but if I was India, I would be saying-

    ‘Well, this is another fine mess you’ve gotten us into, Modi.’

    1. mgr

      As mentioned in the article, losing control of biometric data is not like losing a pin number or password. A pin number or password can be replaced and the damage is generally limited to a particular account. Biometric data like voice, fingerprints, retinal scans, etc. on the other hand is forever and cannot be changed. This is really frightening.

      I don’t know if the biometric data associated with these people has also been taken as part of the breach. Perhaps it is being downplayed. It is not mentioned in the list. If it has though, this is potentially very damaging to the identity security of these people. How do you ever resolve that? It’s one reason why I do not use biometric security.

    2. Hey joe

      They don’t mention that the India gov held poor masses at ransom for gov benefits and welfare by saying won’t be revived anymore unless they were willing complying to the digital takeover

  2. vao

    Aadhaar has been broken into or leaked data repeatedly for the past 12 years, as I already mentioned in a comment a year ago. Here is the message again (notice that as far back as 2018, 164 cases of Aadhaar-related frauds had already been reported):

    The dangers of biometrics as an authentication mechanism for essential services have been amply demonstrated by the Aadhaar system in India. After more than 12 years since it was launched, the authorities have not been able to make Aadhaar tamper-proof. Year after year, criminal gangs get their hands on biometric data and use them to defraud the State or pilfer unsuspecting victims:

    2017: Watch out, Aadhaar biometrics are an easy target for hackers

    2017: Cyber thieves use biometric skimmers to steal Aadhaar info

    2018: Another Aadhaar scam busted: Your data can apparently be tampered with even a rubber thumb

    2018: 164 Aadhaar-Related Frauds Reported Since 2011, Most in 2018: New Database

    2022: In new-age data theft, fraudsters steal thumb prints from land registries

    2022: Goon caught with 2,000 stolen fingerprints in Hyderabad, cops flag ID thefts

    Criticisms have been showered on Aadhaar, but the old iron law applies: once an institution is in place, it requires extraordinary circumstances to abolish it, even if it does not fulfil the requirements, or even is detrimental to achieving the stated objectives.

    1. Vicky Cookies

      It’s rather hard to understand how Gates can live with his impact on others. ‘Defense’ industry folks have their rationalizations, as do (presumably, as I haven’t heard them) the oil-men.
      Gates has, from advancing his milk schemes in central Africa, to his pushing of surplus vaccines in India, Latin America and elsewhere, to this latest nonsense, been functionally one of the world’s most effective misanthropes for years now. I don’t wish to underestimate the extent of elite ignorance and delusion, but in his case, one might think the weight of the evidence would either lead him to conclude that he should stop exercising influence over the lives of others, as his resume shows he is incapable of doing so responsibly; or that the same evidence would lead people generally to reject his leadership in any initiative.

      It is of course possible that his track record could be attributed to malice. Whatever the case, may Bill Gates be stopped.

      1. Nothing Shocking

        Sociopaths don’t reflect on their misdeeds – they literally have no soul. He will never stop until he’s dead. Many like him in positions of extreme power and influence – perhaps the price of admission to the club. Thank God we humans have a sell-by-date that (thus far) eventually turns the lights out.

  3. Paul Art

    Last year I worked mighty hard to get an Aadhar card since its pretty impossible to sell property without it. Fortunately for me I failed. Now I will NEVER get one. It’s a big nuisance though. You can’t get a phone connection or an internet connection without one. India gives OCI (Overseas Citizen of India) cards to expats that is supposed to be a substitute for AADHAR card but no one inside India knows about this. What is OCI? is the question you will hear if you try to use that for a phone or internet connection.

  4. rob

    This example reminds me of 2015, when @ 22 million US gov’t personnel had their “data” stolen. Imagine, all your info; your answers to questions for security clearances, and probably whatever bio-metric stuff that existed back then (if any?)….
    And yet people get paid very well, who keep telling us “it is secure”, and then on top of that…. other morons who get paid very well say…..”hmmm lets make RULES that say everyone MUST digitize their biometric profiles, and other data…. since it is secure, and all”…IRS what?
    And everyone seems to just be going along with it.
    The emperor has no clothes.
    Computers are a tool, not a magical pony
    What the hell is wrong with people?

Comments are closed.