A security researcher said an Indian government website was exposing the Aadhaar numbers of India’s farmers, potentially amounting to millions of people.
Atul Nair told TechCrunch that he found a part of the Pradhan Mantri Kisan Samman Nidhi website that was revealing the farmers’ information. PM-Kisan, as the agency is better known, is an Indian government initiative aimed at providing every farmer in India with basic financial income.
But Nair said a portion of the initiative’s website was returning farmers’ Aadhaar numbers, which farmers have to provide to receive the state income.
Aadhaar numbers are a confidential 12-digit number assigned to each Indian national as part of the country’s national identity database. Aadhaar is used as proof of identity for citizens after submitting their fingerprints and retinal scans to the central database and is often required for accessing state government services, like welfare assistance and voting. Aadhaar numbers are also used for opening bank accounts, renting Airbnbs, driving with Uber and for providing verification for other online services. Aadhaar numbers aren’t strictly secret but are treated similarly to American Social Security or British National Insurance numbers.
He warned that a malicious attacker could have easily gathered the farmers’ information by writing a script. According to PM-Kisan’s website, which appears to be only accessible from within India, more than 110 million farmers have registered since the initiative launched in 2019.
