Road Ministry Orders Forensic Security Audit of Major Portals After Massive Data Leak

Forensic Security Audit

The Ministry of Road Transport and Highways has asked the Indian Computer Emergency Response Team to conduct a forensic security audit of the VAHAN, SARATHI, e-Challan, and PUCC portals. These four platforms hold various types of vehicle-owner information, with Vahan managing vehicle registration records, Sarathi handling driving licences, e-Challan recording traffic violations, and PUCC managing pollution control certificates.

Data Leak Investigation

The move follows reports that vehicle information was sold through multiple apps and websites for as little as five rupees. One Telegram-based channel provided extensive personal data when supplied with a registration number, according to an investigation by Cyderes. Exposed details included full names, parent names, addresses, PIN codes, mobile numbers, driving licence histories, and FASTag information. The Vehicle Information App with 10 million downloads and VehicleSetu with 1 million downloads were also identified, prompting the Ministry to request their removal from Google and other major app stores.

Official Measures

A senior Ministry official stated they sought the intervention of the Ministry of Electronics and Information Technology to review and strengthen its data-sharing policy. The Ministry also plans to audit enforcement agencies accessing its portals. Government bodies can access all data fields under the Digital Personal Data Protection Act, while private entities can access only selected fields with daily limits. Through an RTI request, the Internet Freedom Foundation found that 25,314 credentials had been issued to private entities, running 1.708 crore queries over 33 months. A preliminary investigation also found evidence of data misuse involving the Unified Logistics Interface Platform, with some entities recording over 50 lakh hits in a month. The Ministry has asked the National Informatics Centre to audit ULIP access patterns and tightened technical controls by requiring Transport Secretary approval and Aadhaar-based digital signatures for government agencies, though it ruled out suspending private data sharing.

Context

Transport data portals store sensitive personal and vehicular records that are shared with various agencies and private businesses to support logistics and verification services. Security audits and strict access controls are standard regulatory responses when vulnerabilities or unauthorized data sales are uncovered.