'PhonePe data safe': UPI platform after man held by Cyberabad cops for data theft

PhonePe has denied any data leak after Cyberabad Police nabbed a person for allegedly selling user data pertaining to not just PhonePe but also other companies.

Days after Cyberabad Police, one of three police commissionerates in Hyderabad, arrested a person for allegedly selling confidential data of nearly 67 crore people from companies such as PayTM, PhonePe, Amazon, Byju's, YouTube and so on, PhonePe has assured that no company data has been leaked.

In a statement to Moneycontrol, a PhonePe spokesperson said, "No PhonePe data has been leaked and we continue to work with law enforcement agencies (LEA) to identify on how we can educate our customers from falling for these social engineering frauds."

"The current media refers to data leaks which have been farmed via 3P (third party) data sources and does not pertain to PhonePe," the spokesperson added.

Moneycontrol has further reached out to the company asking for specific details on who or what these third-party data sources can be, and how they can farm such data.

The publication has also reached out to other companies named by Cyberabad Police, whose data allegedly was being sold by Bhardwaj. The article will be updated when a response is received.

On April 2, Cyberabad Police arrested one Vinay Bhardwaj, a resident of Faridabad in Haryana, who was allegedly selling this database on a website called InspireWebz, and was delivering it through cloud drive links.

A press release by the police said that databases secured from Bhardwaj included that of 1.8 lakh Phonepe customers, and it included parameters such as customer name, bank, personal email id, PhonePe numbers, address and city.

"The PhonePe app is totally safe and secure and we have seen no data breach on our platform. Please be assured that we take multiple security measures to make sure every transaction on our platform is safe," the spokesperson added.

Apart from PhonePe, personal data of 50 lakh Paytm customers, including their name, mobile numbers, email, gender, bank and income statements were put up for sale, the Cyberabad Police release said

On the e-commerce side, data of 10.2 lakh Amazon users were also being offered on sale, which includes emails, names, phone numbers, payment methods and so on, according to the police.

In total, the police estimated that Bhardwaj had collected and was allegedly selling data on 1.84 lah cab users, 4.5 lakh salaried persons, data from Goods and Services Tax, pan-India Regional Transport Offices, data on defence personnel, PAN card holders, D-MAT account holders, credit card and debit card holders.

This incident gains significance as India still does not have a data protection law. The Digital Personal Data Protection Bill 2022 is yet to be presented in Parliament. This also highlights the necessity of proper cyber security hygiene within the government and the industry.

This is also the second such case that Cyberabad Police has cracked in the past one month. On March 23, the cops arrested seven people from a gang allegedly involved in the theft and sale of sensitive data of the government and important organisations, including details of defence personnel as well as the personal and confidential data of about 16.8 crore citizens.

The accused persons were found selling more than 140 different categories of information, which include sensitive information such as details of defence personnel and the mobile numbers of citizens and NEET students, among others, Cyberabad Police Commissioner M Stephen Raveendra had said.