6mn Aadhaar Numbers Leaked By Gas PSU: Indian Oil Says ‘No Leak’

The hacker has claimed that nearly 6,700,000 Indane customers could be affected by the ‘leak’.

3 min read
Hindi Female

Nearly 6 million Aadhaar numbers have been leaked through a vulnerability on the Indane website meant for dealers and distributors, a French ‘ethical hacker’ who goes by the name Elliot Alderson claimed on Twitter.

In a blog posted on Monday, 18 February, Alderson detailed how he got a private message on 10 February, alerting him to a vulnerability on a web portal meant for local dealers. The Indane portal reportedly exposes the names, Aadhaar numbers and addresses of the customers.

A lack of authentication in this portal means that if one has information on other dealers — i.e. a ‘dealer ID’ — then it is possible to access the information of 6,791,200 Indane customers, according to Alderson.

Indian Oil Corp responded to the allegations on Twitter, saying that “leakage of Aadhaar data is not possible through us.” In its statement, a differentiation has been made between Aadhaar data and Aadhaar numbers. However, the allegation of leak by Alderson is about Aadhaar numbers. In fact, the UIDAI has clarified in the past that Aadhaar numbers qualify as sensitive data.

The Unique Identification Authority of India (UIDAI) has not publicly responded to the allegations. The Quint has also reached out to UIDAI for a response through email.


Indane, an LPG brand owned by the Indian Oil Corporation, is one of the country’s largest gas companies.

Explaining The ‘Leak’

Alderson has claimed that the local dealer portal on Indane was not protected by any authentication.

In an image posted by Alderson, there’s a field that requires dealer IDs to be entered. Once the ID is entered, the Aadhaar numbers, names and addresses of customers registered with the specific dealer can be accessed, according to the security researcher.

The hacker has claimed that nearly 6,700,000 Indane customers could be affected by the ‘leak’.
A screenshot of the dealer portal shared by Elliot Alderson, in his blog post. 
(Photo Courtesy: Elliot Alderson/

To understand how many customers could be potentially impacted, Alderson sought to get IDs of 11,000 Indane dealers. According to the blog, he created a code that accessed dealer IDs of some dealers through Indane’s Android app.

Once the dealer IDs were obtained, Alderson went on the portal again and was able to access the Aadhaar information of nearly 6 million customers. Indane blocked Alderson’s IP after one day, so he couldn’t test the remaining dealers. By his estimation, the customers who could be affected by the alleged leak go up to 6,791,200.

TechCrunch verified some of the numbers that came up in Alderson’s account by using UIDAI’s web-based verification tool. Each number used came back as a match, the report said.


Not The First Time

This is not the first time that Aadhaar information (numbers, name and addresses) have been stored on vulnerable online spaces. In March 2018, a data leak on Indane had allowed “anyone to download private information on all Aadhaar holders,” according to ZDNet.

In September last year, The Quint had reported that “private entities of various kinds, educational, non-profit or commercial” kept entire directories of Aadhaar numbers open and searchable on Google. According to the report, this meant that a search of “aadhar.jpg” on Google could lead to an extensive database of Indian citizens.

(The article will be updated if UIDAI responds to The Quint’s queries.)

(With inputs from TechCrunch)

(At The Quint, we are answerable only to our audience. Play an active role in shaping our journalism by becoming a member. Because the truth is worth it.)

Read Latest News and Breaking News at The Quint, browse for more from news and india

Topics:  UIDAI   Aadhaar leak 

Speaking truth to power requires allies like you.
Become a Member
3 months
12 months
12 months
Check Member Benefits
Read More