Threat actors lack access to entire CoWIN portal or backend database: Report

Cybersecurity firm CloudSEK has stated that threat actors do not possess access to the entire CoWIN platform or its backend database, contradicting reports of a data breach that were dismissed by the Union health ministry.

“Based on matching fields from Telegram data and previously reported incidents affecting health workers of a region, we assume the information was scraped through these compromised credentials,” CloudSEK said in a report on Monday (June 12) after an independent analysis.

On March 13, a threat actor on a Russian cybercrime forum advertised for compromised access on the CoWIN portal of Tamil Nadu region, it said.

Also Read: Govt says CoWIN safe, data from ‘past breach’; how is it safe then, asks Oppn

After an analysis, CloudSEK said, it was discovered the breach was that of a health worker and not really of the infrastructure. The content displayed on the screenshot matches with the Telegram bot mentioned in the media as follows — name of the individual, mobile number, identity proof, identification number and number of doses completed.

“Furthermore, there are numerous healthcare worker credentials accessible on the dark web for the CoWIN portal. However, this issue primarily stems from the inadequate endpoint security measures implemented for healthcare workers, rather than any inherent weaknesses in CoWIN’s infrastructure security,” the report said.

Asserting that the CoWIN portal was completely safe with adequate safeguards for data privacy, the Union health ministry on Monday dismissed as “mischievous” the claims of a data breach on the platform and said the matter had been reviewed by the country’s nodal cyber security agency CERT-In.

In a statement, the ministry also said that an internal exercise had been initiated to review the existing security measures.

Also Read: Politicians’ data on Telegram: TMC’s Saket Gokhale alleges CoWIN leak

“With reference to some alleged CoWIN data breaches reported on social media… the Indian Computer Emergency Response Team (CERT-In) immediately responded and it does not appear that the CoWin app or database has been directly breached,” said Union Minister of State for Electronics and Information Technology Rajeev Chandrasekhar.

In its statement, the health ministry said there was no basis for the reports alleging the breach of data from the CoWIN portal, a repository of all data of all those who have been vaccinated against COVID-19 in the country.

“It is clarified that all such reports are without any basis and mischievous. The Co-WIN portal of the health ministry is completely safe with adequate safeguards for data privacy,” it had said.

CERT-In, in its initial report, has pointed out that the backend database for the Telegram bot was not directly accessing the APIs of the CoWIN database, according to the statement.

(With agency inputs)