Thursday, March 28, 2024

Indian Provident Fund Portal Hacked: Attackers May have been Stolen 27 Million Users Sensitive Data

A cyber Attack launch into Indian Provident Fund Portal called “Employees  Provident Fund Organization(EPFO)” and hackers may have been stolen around 27 Million registered peoples sensitive data.

The personal and professional details of about 27 Million Indian Peoples registered with the retirement fund body Employees Provident Fund Organisation (EPFO).

A hacked website (Aadhaar.epfoservices.com)provides an Aadhaar Seeding Service for EPFO that has been managed under Indian Government infrastructure called Information and Communication Technology (ICT).

Attackers Exploiting two critical vulnerabilities calledStruct Vulnerability  &  Backdoor shell”  which exists on the hacked website that allow an attacker to successfully compromise the website and gave access to stolen the million of Peoples Sensitive Data.

“backdoor shells” allows hackers gaining control of a portal’s administrator privileges and “Apache Struts”, a widely used Java application that contains a critical vulnerability.

This Attack was launched to target an Aadhaar number and cybercriminals may have been stolen a huge amount of data and the breach has been notified on 22/03/2018.

Letter from VP Joy, Central Provident Fund Commissioner

In the letter checked “secret”, the official composed that the Intelligence Bureau (IB) had Informed them of”hackers exploiting the vulnerabilities prevailing in the website (aadhaar.epfoservices.com) of EPFO.

EPFO is just one of many government departments that use this platform for Aadhaar-seeding various services.

Cyber Security Experts Said, “Each person contributes 12% of salary as provident fund, so salary details could also have been stolen. Also the bank account numbers as people tend to withdraw their PF,”.

The report additionally includes that the central provident fund commissioner has asked the service’s specialized staff to plug vulnerabilities on the entryway that has now been temporarily shut down. For the obscure, the entrance interfaces the Aadhaar number of all workers with their provident fund accounts.

The hacked website contains information about the names and addresses of EPF subscribers besides their employment history.

Few Month before  Indian Aadhaar Details Exposed in Public by More than 200 Government Websites.

Aadhaar Officials said “This matter does not pertain at all to any Aadhaar data breach from UIDAI servers. There is absolutely no breach into Aadhaar database of UIDAI. Aadhaar data remains safe and secure,”.

Website

Latest articles

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...

Hackers Actively Exploiting Ray AI Framework Flaw to Hack Thousands of Servers

A critical vulnerability in Ray, an open-source AI framework that is widely utilized across...

Chinese Hackers Attacking Southeast Asian Nations With Malware Packages

Cybersecurity researchers at Unit 42 have uncovered a sophisticated cyberespionage campaign orchestrated by two...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles