2 Bihar brothers used mother’s CoWIN ID to leak data: Delhi Police

Based on the investigation, his minor brother, aged around 17, was also found to be involved in the case and apprehended from their house. The police brought the two to Delhi and produced them before the court. The brothers are being questioned by the Delhi Police and other agencies in connection with the data breach.

Sources said the two created the Telegram bot to merely “gain more followers”. According to the police, the two did not sell the data to anyone.

The two brothers used the log in ID and credentials of their mother, an Auxiliary Nurse Midwife (ANM) in Patna, to access the data on CoWIN.

“The mother will also be questioned. She was not aware that her CoWIN ID had been compromised. While not much is known, we found that the sons gained access to the mother’s ID and took data of a few individuals from Bihar. They created a bot and circulated the information on their Telegram channel to gain more followers. At present, we haven’t found any other motive,” said a senior police officer from the Special Cell.

Experts said ANM workers only have access to data for the people they vaccinate. The data is also limited to phone numbers, dosage information and district centre information.

Last week, reports surfaced on a purported breach of data of beneficiaries registered on the CoWIN platform. The data had been accessed by a Telegram bot, which revealed the gender, date of birth, Aadhaar details, address, centre for vaccination etc. of beneficiaries. On June 12, the Union Ministry of Health and Family Welfare issued a press release stating that the Telegram bot was not using CoWIN’s application programming interface.

Minister of State for Electronics and Information Technology Rajeev Chandrasekhar said the Indian Computer Emergency Response Team (CERT-In), the nodal cyber security agency, had reviewed the alleged breach and found the CoWIN portal was not “directly breached”. The government stated that the bot was using “previously breached databases”.

This is the first arrest in the data breach case. However, senior police officers said the accused were not involved in the “major data breach”, which involves data leak of thousands of people from across states. The arrested duo had access to data of only a few individuals, they said.

The investigation was conducted with the help of Telegram platform and CERT-In. “The matter is at a preliminary stage and not much can be revealed. The men were not selling the data to anyone in particular. They only had access to certain ID and data which they used to create a software (bot) and share on social media,” said a source.