CoWIN data 'leak': TMC MP Derek O'Brien lodges complaint with Kolkata cyber police, seeks probe

TMC Rajya Sabha MP Derek O'Brien (File image: PTI)

Trinamool Congress lawmaker Derek O'Brien has submitted a complaint to the Kolkata cyber police, seeking the registration of a first information report (FIR) and an investigation into the alleged leak of data from the CoWIN portal set up for COVID-19 vaccination by the central government.

The "nationwide breach of data has affected lakhs of citizens", O'Brien said, adding that their sensitive information including date of birth, family members, mobile numbers and passport details have been "leaked".

"...it seems there is a notorious conspiracy at play to make sensitive information available to private players through government resources," he added.

The Rajya Sabha MP requested the police to register a case under relevant sections of the Indian Penal Code and the Information Technology Act, and crack down on the "anti-social elements" involved.

O'Brien's letter to the police, dated June 14, came to the fore after reports said that a bot linked to social media app Telegram breached the CoWIN portal and gained access to the data of scores of Indians who had booked slots for vaccination against coronavirus.

The Union health ministry, however, has refuted the reports, stating that such claims are "baseless" and "mischievous". The CoWIN portal is "completely safe with adequate safeguards for data privacy", it added.

"Furthermore, various security measures are in place on the CoWIN portal. Only OTP authentication-based access to data is provided. All steps have been taken and are being taken to ensure the security of the data in the CoWIN portal," a press release further noted.

Union Minister of State for Electronics and Information Technology Rajeev Chandrasekhar, while commenting on the report of data leak, said that the matter had been reviewed by nodal cybersecurity body CERT-IN.

According to the minister, the data that was being accessed by the Telegram bot was from a threat actor database that was populated “with previously breached/stolen data from the past”. The CoWIN app or database was not been directly breached, he added.