Categories: Data BreachHacks

Serious Security flaw Employee’s Provident Fund organisation | EPFO

Employee’s Provident Fund organisation a statutory body under ministry of labour and employement, an Universal Account Number (UAN) will be generated for each of the PF contributing members.e UAN will act as an umbrella for the multiple Member Ids allotted to an individual by different establishments.

Indian security firm Eioneus systems  discovered a serious security flaw on 3rd Dec 2016 and it was reported by them immediately to CERT-IN, NIC, and other government sources which were felt necessary  at the time.

As per the report’s available the issue was critical and it will give full access to the machine, which leads to compromise the entire system.The Tech team also disclosed the vulnerability behavior.

UANUAN

Snehil Khare official of Eioneus system clarified their intentions stating

“Our motive is to do a responsible vulnerability disclosure and not to abuse the information which was accessed. Our intention was to draw the attention of authorities towards major security concern identified, without ignoring it.”

Due to the very sensitive nature of the incident complete details was not disclosed, but it came to lime light that bug gave access to information such as Provident fund balance, Individual’s KYC details, phone numbers, PAN numbers, bank details ;etc of every provident fund user in the country.

The techfirm also disclosed some screenshot’s to prove they have access to databases.

Here you also find the report submitted by the Techfirm to CERT-IN (Computer emergency response team) and was acknowledged by CERT-IN in no time.

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

MATLAB, Serving Over 5 Million Users, Hit by Ransomware Attack

MathWorks, the renowned developer of MATLAB and Simulink, has been grappling with the aftermath of…

1 hour ago

CISA Publishes ICS Advisories Highlighting New Vulnerabilities and Exploits

On May 27, 2025, the Cybersecurity and Infrastructure Security Agency (CISA) released a new Industrial…

2 hours ago

Chrome Security Patch Addresses High-Severity Vulnerabilities Enabling Code Execution

The Chrome team at Google has officially released Chrome 137 to the stable channel for…

2 hours ago

Zero-Interaction libvpx Flaw in Firefox Allows Attackers to Run Arbitrary Code

Mozilla has released Firefox 139, addressing several critical and moderate security vulnerabilities that posed significant…

3 hours ago

INE Security And RedTeam Hacker Academy Announce Partnership To Advance Cybersecurity Skills In The Middle East

INE Security, a global cybersecurity training and certification provider, today announced a strategic partnership with…

3 hours ago

Threat Actors Use Fake DocuSign Notifications to Steal Corporate Data

DocuSign has emerged as a cornerstone for over 1.6 million customers worldwide, including 95% of…

19 hours ago