CoWIN data ‘breach’: Opposition demands investigation, questions minister on ‘previous breach’

Union Minister of State for IT, Rajeev Chandrasekhar, said it does not appear that the CoWIN app or database has been directly breached and pointed out that Indian Computer Emergency Response Team (CERT-In) has immediately responded and reviewed the matter.

Congress general secretary (Organisation) K C Venugopal said: “The duty of any entity, especially the government, is to protect individual privacy above everything else. This responsibility also extends to destroying data, which is no longer required, so that it is not vulnerable to such breaches. If not, the entity must have watertight mechanisms to protect data in its custody.”

The Trinamool Congress asked why the government has ordered a probe if reports are mischievous and without basis. The party’s national spokesperson, Saket Gokhale, stated, “It is shocking that we’re now finding out personal data, Aadhaar, Passport details, Voter ID details of over 1.5 billions were stolen from the CoWIN database.”

While Chandrasekhar said that “it does not appear that CoWIN app or database has been directly breached”, Venugopal countered that the minister’s response was “casual” and said, “This breach clearly shows that CoWIN data was not encrypted. If it were, only those with the necessary authorisation will be able to access such data, and random Telegram bots will not be able to decrypt such personal data.”

“Since you mention ‘previously breached/stolen data,’ you’re clearly admitting that CoWIN data has already been breached…” he said.

Congress’s communications head Jairam Ramesh tweeted:

“The personal data breach is a very grave matter… The tech-savvy Minister instead of issuing casual WhatsApp forward style tweets should hold a Press Conference at the earliest and clarify at the very least: What he means by “previously stolen data stolen” — stolen from which database, when, and what action was taken? 2. If CoWIN database hasn’t been “directly breached”, is the Minister then accepting that it is an indirect breach? What other databases are linked to the CoWIN database…”

TMC’s Gokhale asked in a similar vein: “Union Minister claims “Cowin is safe & there’s no breach”. He also says “this data could be data stolen in the past”. So he’s admitting there was a breach in CoWIN in the past & data was stolen? Why were Indians not informed about it? And how, then, is CoWIN “safe”?”

Calling reports of data breach shocking and a matter of “serious concern”, the CPI(M) stated, “The Health Ministry in June 2021 had denied a similar allegation, but it had nevertheless ordered an investigation into the alleged leakage from the CoWin system by Computer Emergency Response Team…. The details of this investigation are not yet in public domain.”