Cyberabad police arrests Haryana man for selling confidential data of nearly 67 crore people

The accused was found to be in possession of confidential data on 4.5 lakh salaried employees from six cities.

Cyberabad Police on March 31 arrested an accused for allegedly stealing, storing and selling confidential data of 66.9 crore individuals, including data of students belonging to edtech platform Byju's and Vedantu, users of financial apps such as Paytm, Phonepe, CRED and users of Amazon, Netflix, YouTube, Instagram, Zomato and others.

The accused, Vinay Bhardwaj -a resident of Faridabad in Haryana - was also in possession of data on 1.84 lakh cab users, 4.5 lakh salaried persons, data from Goods and Services Tax, pan-India Regional Transport Offices, data on defence personnel, PAN card holders, D-MAT account holders, credit card and debit card holders, said a press release by Cyberabad police.

Bhardwaj, who operated from an office in Faridabad allegedly collected these databases from one Amer Sohail and Madan Gopal. “He used to advertise the data for selling (on) social media platforms,” the press release claimed. The accused was also selling the data on a website called InspireWebz through cloud drive links, police said.

This case highlights the necessity of robust, secure systems within the government, and also among private players. It is also important to point out that the country still does not have a data protection law. Consultations have been undertaken on the Digital Personal Data Protection Bill 2022 but it is yet to be presented in the Parliament.

Police further said that on data 18 lakh students of Byju's and Vedantu include first name, their phone numbers, location and other information.

Personal data of 50 lakh Paytm customers, including their name, mobile numbers, email, gender, bank and income statements were put up for sale. Similarly, 1.8 lakh users of PhonePe had their data stolen by the accused, police said.

Agreement ID, customer ID, customer name, marital status, KYC details and other sensitive information from CRED was put up for sale, while information about customer name, sum insured, plan type and so on from PolicyBazaar was also compromised.

On the e-commerce side, data of 10.2 lakh Amazon users were also being offered on sale, which includes emails, names, phone numbers, payment methods and so on, Cyberabad police said.

Cyberabad police also found databases of vehicle owners, data on job aspirants, real estate, construction, manufacturing and industrial sector, frequent flyer details and NRIs in the accused's possession.