All you need to know about Cyberabad Police's crackdown on data theft of 67 crore individuals

What happened?

Bhardwaj, who collected these databases from one Amer Sohail and Madan Gopal, was advertising on social media for selling them. The database has details of individuals from 24 states and eight metropolitan cities.

What has the police recovered from the accused?

Police recovered two mobile phones, two laptops, and data of 135 categories containing sensitive information of government, private organisations and individuals.

What are the significant government databases that have been recovered?

Cyberabad Police said that data includes, confidential data of defence, government employees; PAN card holders, data of NEET students with their names, fathers' names, mobile numbers and addresses, insurance data, and so on.

What are the police doing now?

The police have issued notices to as many as 11 organisations whose customer data was recovered from the databases being sold by Bhardwaj, PTI reported. The police have asked their representatives to be present before the police and explain how their data was found in the possession of the accused.

How have the organisations responded?

PhonePe, whose data was allegedly recovered in the database that was being sold by Bhardwaj, has denied any data leak. In a statement to Moneycontrol, the fintech unicorn platform said that that the data has "been farmed via  3P data sources and does not pertain to PhonePe". The publication has also reached out to organisations such as Zomato, Byju's, Google, Meta and for others with queries regarding the matter.

Why is this incident significant?

India still does not have a data protection law that would effectively provide more ways to deal with such incidents. This incident also highlights the necessity of robust cyber security measures in both government and industries. As of now, several provisions of the Information Technology Act govern cases of data mishandling, selling, storage of confidential data and so on.

How would the Digital Personal Data Protection Bill deal with such situations?

Although there are no criminal provisions mooted in the draft of the DPDP Bill, the government has mooted fines upto Rs 500 crore for companies for failing to secure personal data. Under the DPDP Bill, a data protection regulator will also be formed that will oversee such matters and decide on penalties and so on.

However, experts have argued that penalties in India's DPDP Bill fall short when compared to other similar legislation worldwide.

What is the political ramification of this arrest?

Congress has sought clarification from the government over the theft of personal data, asserting that this was an attack on the privacy and security of Indians. Tagging a media report on the case, Congress general secretary Jairam Ramesh said in a tweet in Hindi, "How and why was personal information of 67 crore people of India stolen? Who stole the data of the army and how?"

Is this incident the first of its kind?

No. A month ago, Cyberabad Police arrested seven people from a gang for allegedly stealing and selling sensitive data of government and organisations including details of defence personnel as well as personal and confidential data of 16.8 crore citizens.