Case Investigation Report: Aadhaar Data Breach Incident Analysis

This case investigation report delves into the Aadhaar data breach, a significant cybersecurity incident impacting over a billion individuals. The report meticulously analyzes the threats, vulnerabilities, and exploits that led to the breach, including third-party leaks, flaws in the mAadhaar app, and the exploitation of government websites. It examines the legal and ethical implications faced by the UIDAI, the organization responsible for Aadhaar, highlighting issues of data privacy and confidentiality. The consequences of the breach are assessed, including the erosion of public trust and the shift from mandatory to voluntary use of Aadhaar services. The report identifies key lessons learned, such as the high cost of data leakage and the importance of organizational responsibility. Finally, it offers recommendations for improving security measures, including enhancing security systems, implementing data encryption, and keeping security software up-to-date. This analysis provides a comprehensive understanding of the incident and offers valuable insights for improving data security practices.

Running head: CASE INVESTIGATION REPORT
Case Investigation Report
Name of the Student
Name of the University
Author Note

1CASE INVESTIGATION REPORT
Table of Contents
Introduction:....................................................................................................................................2
Threats, Vulnerabilities and Exploits analysis:...............................................................................2
Legal and Ethical issues analysis:....................................................................................................4
`Consequences of the Data Breach analysis:...................................................................................5
Lessons Learned:.............................................................................................................................6
Recommendation:............................................................................................................................7
Conclusion:......................................................................................................................................8
References:......................................................................................................................................9

2CASE INVESTIGATION REPORT
Introduction:
Currently, the data breach is one of the most important issue in the aspect of information
security. Data breach is actually the unintentional or intentional release of some confidential or
the secured type of information within an untrusted type of environment (Sen and Borle 2015).
The definition of data breach also includes information leakage, data spill and leakage of data.
Common type of data breach includes disclosure of personal information that are sensitive in
nature. This type of information consists personal social media information, credit card numbers,
corporate information and healthcare histories. Basic reasons for which a data breach occurs are
the hacking activities, unauthorized type of access gain and accidentally sending some crucial
information to the wrong recipients.
In the context of data breach, one of the biggest data breach of the history was the
Aadhaar data breach which took place last year in India. Aadhaar is actually a 12 digit of random
numbers which are unique in nature for each of the persons of India. This is a unique way of
identification of the citizens of India. This includes both of the demographic information and
biometric information of the citizens of India which are highly sensitive data. But in the last year
these data were breached due to which more than 1 billion peoples were affected.
Threats, Vulnerabilities and Exploits analysis:
The data breach of the Aadhaar happened due to various of reasons which includes flaws
in the application itself and improper security at the official website of them. Thus properly
understanding the issues in the Aadhaar proper analysis of threats, vulnerabilities and exploits
are required in this case.

3CASE INVESTIGATION REPORT
 Threats Analysis: In this context the main threats with this system was the third party
leaks. It has been assessed that there was various of third party leaks regarding the
demographic data of the individuals who were registered in the Aadhaar database (Pope
2018). One of the major cases due to which threats occurred in this system that leak of
infrastructure of the Aadhaar application. This leak was done by the CSC e-governance
Services India Ltd. In this leak they posted a picture with the machine that used for the
Aadhaar application along with the application screen open of the individuals. In this
screen bulk personal details were visible due to which threat occurred in the in the overall
system. Also, there are several of applications are there which claims that they provide
Aadhaar related services but actually all of these was fraud applications which was used
for collecting personal information of the users. It is also assessed that about 5000
officials were having Aadhaar portal access without any type of proper authorization
which was also a major threat for the Aadhaar related services. Vulnerability Analysis: In the detailed analysis it has been also assessed that the Aadhaar
program was having some vulnerability in their system which made major contribution in
this data breach case. The mAadhaar app of the Aadhaar program was some serious flaws
in it due to which the whole system becomes vulnerable. This application was available
in Google Play Store and from there it was analyzed by a French security researcher
(Tyagi, Rekha and Sreenath 2018). That security researcher showed the current flaws in
the application. It was very much guaranteed that the hackers used those flaws for to get
access to the Aadhaar database which will provide the demographic data of the users as
the process was simple for most of the hackers. A college graduate was also able to get
access to the database of the Aadhaar without any type of proper authorization. For this,

4CASE INVESTIGATION REPORT
the student used some simple mechanism through which he was able to get access to the
database. This was all contributed in the data breach issue of the Aadhaar program of
Indian Government. Exploits: During this data breach case of the Aadhaar program various of exploits were
also used by the hackers. Due to this billions of users data were compromised. This data
of the individuals has been exploited in multiple of instances. In this case the data has
been leaked through online government websites. From the recent analysis it has been
assessed that there were about 210 of government websites which was used by the
hackers for exploiting the data of Aadhaar (Raju, Singh and Khatter 2017). These data
were also made public on the internet. From the report it is also assessed that these data
was removed from the websites but there was no mention of the timeframe of leaking of
the data. Here the exploit was so much damaging that a simple Google search results
were revealing so much of personal data of the random persons who were enrolled for the
Aadhaar registration. This data was consisting names of the individuals, mobile numbers,
addresses, PAN numbers, bank account numbers, religions and the Aadhaar number
itself.
Legal and Ethical issues analysis:
Due to this data breach of Aadhaar there was various of issues faced by the UIDAI which
is responsible for the all the operations related with the Aadhaar. In this case the main issues that
was faced by the UIDAI were the legal issues and the ethical issues. Both of the issues is having
major implication on the UIDAI and on its operations.
 Legal Issues: Due to this data breach issue of the Aadhaar it has faced some of the
serious legal issues. UIDAI was responsible for collecting data the data from the users

5CASE INVESTIGATION REPORT
and due to the fact they were also responsible for protection of those data in which they
were completely failed (Chamuah 2018). Due to this reason there was a huge controversy
regarding ban of the Aadhaar in India. In many of the sections this Aadhaar was
mandatory previously which was then made voluntary as there was tremendous risk of
data breach with the Aadhaar. Basically, the privacy related issues were faced by the
Aadhaar project in this case. Ethical Issues: With the legal issues the project of Aadhaar also faced some crucial
ethical issues regarding this data breach case. Confidentiality of the personal data is one
of the most important ethics whenever any organization is collecting data from the users
of it. But, in this case the UIDAI failed to protect all the confidential information that
they collected from the user end (Bhandari and Sane 2019). This was of the most
important ethical issue which is faced by the Aadhaar program due to the data breach
case. In this case incident response of the UIDAI also raised ethical issues. The UIDAI
failed to inform the data breach issue proactively so the users can take further steps for
preventing any type of future frauds. Even UIDAI were also unaware about that their data
has been breached. Whenever some important data is collected from the user’s side, these
data need to be protected with proper encryption procedures which were also not
implemented by the UIDAI (Tanwar et al. 2019). Due to this factor encryption related
issues were also faced by the Aadhaar project.
`Consequences of the Data Breach analysis:
Due to this data breach incident of Aadhaar there were more than one billion peoples who
left affected from this. Here personal information of more than one billion peoples exposed
which was including the name of the individuals, their biometrics information and most

6CASE INVESTIGATION REPORT
importantly their bank account details (Henne 2019). As all of this crucial information were
leaked due to the data breach incident there was overall negative consequences reflected on the
UIDAI. First of all the trust of the peoples on the UIDAI and the Aadhaar program reduced
heavily. Also, previously the Aadhaar was mandatory in many of the areas of India which
includes opening a bank account to the deposit of the taxes to the government. But after this data
breach issue all of these becomes mandatory to voluntary. Means the priority of the Aadhaar for
this type of official works reduced drastically. The UIDAI was a part of the government projects
and for that UIDAI saved from various of other issues in this case. Though this data breach issue
was the complete fault of the UIDAI it does not faced some big challenges regard this case. But
due to this data breach issue users of Aadhaar faced some serious issues.
Lessons Learned:
From this data breach issues of the Aadhaar program of UIDAI various of lessons has
been learned in this context. In this context three important lessons has been learned from this
data breach issue of the Aadhaar card. In the following section brief discussion regarding these
lessons will be discussed.
 The first lesson that has been learned in this context is that leakage of the data and the
loss of the data can be extremely costly both for the organizations and the users. For this
case it has been assessed that hackers can easily get the bank account details of the users
of this Aadhaar program (Misra 2019). Thus it can be an extreme loss for the users if
further their bank account got hacked. Also, these data can be used by the hackers to use
various of services in India which requires the identity proof. Thus data must be protected
with top most priority.

7CASE INVESTIGATION REPORT
 The second lesson that has been learned in this context is that members, stakeholders and
the organization are the main responsible when this type of data breach issues occurs. For
the data breach issue of the Aadhaar the main culprits was the hackers who used the
vulnerability in the system to hack millions of personal data of the Indian citizens.
Though the hackers were the main culprits in this case, UIDAI also have to take
responsibility of this incident as all of those data was under the protection of them. Thus
they must be implementing proper security measures through which these confidential
data can be saved in which UIDAI completely failed.
 The third lessons that has been learned in this context is that third party vendors can be
risky at some moments. Authorizing some important access to the crucial information of
the organization can be harmful in many of the case which has been also seen for the
Aadhaar data breach. In this case CSC e-governance Services India Ltd was accused for
leaking some crucial information of the Aadhaar infrastructure. This leading to the fact
that whenever an third party organization is having some special access to the data, the
policy of accessing those data must be assessed properly (Shahin and Zheng 2018). Also,
the security implication of those third party organizations must be assessed properly.
Recommendation:
The Aadhaar data breach was the largest data breach case in the world which affected
approximately over one billion people. Due to this data breach users of this program faced
various of issues. In this context some recommendation is provided for this type data breach so
the organizations can mitigate this type of data breach issue in further cases.
 The UIDAI was hacked several of times and each of the time it has been assessed that
there was a major fault of the security system of Aadhaar program. Thus it is

8CASE INVESTIGATION REPORT
recommended that UIDAI must improve their security system so that further hackings
can be stopped.
 There is no data encryption has been implemented by the UIDAI. Thus it is
recommended to implement the encryption on the collected raw data so that extra layer of
security can be achieved.
 It is also recommended to keep the security related software always up-to-date for
resisting these type of attacks.
Conclusion:
From the above discussion it can be concluded that the data breach incident of the
Aadhaar was one of the biggest scandal in the history of the data breaches, in fact it was the
largest data breach incident of the history in which more than one billion peoples were affected.
It has been assessed that this data breach was possible for the hacker as the security system of the
UIDAI was very much poor. Thus in this paper a case investigation report has been prepared
regarding the data breach issue of the Aadhaar in India. In this report first the threats,
vulnerabilities and the exploits has been analyzed regarding the data breach issue of Aadhaar
program of UIDAI. In this aspect the main vulnerabilities and the exploits that are used for the
data breach has been discussed. Following that legal and the ethical issues that are faced by the
UIDAI for this data breach has been discussed briefly in this report. In the further discussion
consequences of the data breach incident of Aadhaar that has been faced by the UIDAI is
discussed briefly. This report also consists lessons that has been learned from this data breach
incident and with that important recommendations for mitigating this type of data breach issue in
future has been discussed in the further section.

9CASE INVESTIGATION REPORT
References:
Bhandari, V. and Sane, R., 2019. A critique of the Aadhaar legal framework.
Chamuah, A., 2018. For a Sociology of Aadhaar. Contributions to Indian Sociology, 52(3),
pp.343-347.
Henne, K., 2019. Surveillance in the Name of Governance: Aadhaar as a Fix for Leaking
Systems in India. In Information, Technology and Control in a Changing World (pp. 223-245).
Palgrave Macmillan, Cham.
Misra, P., 2019. Lessons from Aadhaar: Analog aspects of digital governance shouldn’t be
overlooked.
Pope, C., 2018. Biometric Data Collection in an Unprotected World: Exploring the Need for
Federal Legislation Protecting Biometric Data. JL & Pol'y, 26, p.769.
Raju, R.S., Singh, S. and Khatter, K., 2017. Aadhaar Card: Challenges and Impact on Digital
Transformation. arXiv preprint arXiv:1708.05117.
Sen, R. and Borle, S., 2015. Estimating the contextual risk of data breach: An empirical
approach. Journal of Management Information Systems, 32(2), pp.314-341.
Shahin, S. and Zheng, P., 2018. Big data and the illusion of choice: Comparing the evolution of
India’s aadhaar and China’s social credit system as technosocial discourses. Social Science
Computer Review, p.0894439318789343.
Tanwar, S., Tyagi, S., Kumar, N. and Obaidat, M.S., 2019. Ethical, Legal, and Social
Implications of Biometric Technologies. In Biometric-Based Physical and Cybersecurity
Systems (pp. 535-569). Springer, Cham.

10CASE INVESTIGATION REPORT
Tyagi, A.K., Rekha, G. and Sreenath, N., 2018, December. Is your Privacy Safe with Aadhaar?:
An Open Discussion. In 2018 Fifth International Conference on Parallel, Distributed and Grid
Computing (PDGC) (pp. 318-323). IEEE.