CoWIN vaccine database in the eye of a leak storm

Sensitive personal information, including details of identity documents such as Aadhaar and passports, of those who took or signed up for Covid-19 vaccines was freely accessible for an unknown duration, according to reports and screenshots shared by those who found the illicit service on Monday, prompting criticism from experts and Opposition leaders even as the government denied a breach had taken place.

- Deeksha Bhardwaj and Rhythma Kaul

First reported by a Malayalam news website, The Fourth, the data leak was being enabled through an automated account on the messaging application Telegram. The account, technically a bot, responded with the name, date of birth, identity document type and number, and location of last vaccination linked with a mobile phone number sent to it.

“It is clarified that all such reports are without any basis and mischievous in nature. CoWIN portal of health ministry is completely safe with adequate safeguards for data privacy,” the Union health ministry, which maintains the service, said in a statement.

In a separate rebuttal in a tweet, Union minister of state for electronics and technology Rajeev Chandrasekhar said it does not appear that CoWIN app or database has been directly breached”, and said that the data being accessed seems to have been populated with data stolen previously”.