Indane leaked millions of Aadhaar numbers—French security researcher

New Delhi, Feb. 19 (IANS): Indian Oil Corporation Ltd. on Tuesday denied claims by a French security researcher that the company’s Indane website leaked Aadhaar data of over 67 lakh customers.
Baptiste Robert, who goes by the online handle Elliot Alderson, wrote in a blog post on Medium on Tuesday that he investigated the issue after receiving an anonymous tip from a Twitter follower.
Alderson’s probe revealed that information in a part of the Indane website was not secured with adequate safeguards.
“Due to a lack of authentication in the local dealers portal, Indane is leaking the names, addresses and the Aadhaar numbers of their customers,” he wrote in the blog post.

IndianOil denied the claims saying that the company in its software captures only the Aadhaar number which is required for LPG subsidy transfer.
“No other Aadhaar related details are captured by IndianOil. Therefore, leakage of Aadhaar data is not possible through us,” IndianOil said in a statement.

“In the past, oil marketing companies on time to time basis were hosting the consumption of subsidised LPG refills by customers, multiple connections list having customer information like customer number, name LPG id, and address, in public domain (transparency portal) in their respective websites which was available for social audits. There is no Aadhaar number hosted on this website,” the statement added.

Alderson, who introduces himself to be the “worst” nightmare of Aadhaar regulator Unique Identification Authority of India (UIDAI), said that Indane has a total of 11,062 dealers but he could test only 9,490 dealers as Indane “probably” blocked his IP.