Airtel India has strongly rebutted allegations of a data breach after reports emerged suggesting that personal details of over 37.5 crore Indian customers were up for sale on a prominent hacking forum. According to an Airtel spokesperson quoted in India Today, the company categorically denied any compromise of its systems, describing the claims as an attempt to damage its reputation by vested interests. The spokesperson stated that Airtel conducted a thorough investigation and found no evidence of a breach from its systems.
The controversy arose when Dark Web Informer, which monitors activities on the dark web, highlighted a post by a hacker named ‘xenZen’. This post purportedly offered a database containing sensitive information such as mobile numbers, dates of birth, father’s names, Aadhaar IDs, and email IDs of Airtel India customers for sale at $50,000 USD (about Rs 41 lakh) in cryptocurrency. The hacker claimed the breach occurred in June 2024 and provided a sample of the data, also asserting involvement in a previous breach targeting the Ministry of External Affairs’ database of diplomatic passport holders.
While security researchers acknowledge the uncertainty surrounding the alleged data breach involving Airtel, there is skepticism that the data might not be fabricated. Nicolas Krassas, a cybersecurity expert associated with Henkel AG, retweeted information on the alleged breach, suggesting it might have validity. Srinivas Kodali, known for his views on cybersecurity, highlighted the situation, alleging that a China-based threat actor had breached Airtel and listed the data for sale on breach forums, although the actor is now suspended from the forum.
Previously, concerns were raised in 2021 when details of over 2.5 million Airtel subscribers appeared on a website associated with the ‘Red Rabbit Team’ threat actor. Airtel had denied any breach at that time. Incidents involving data breaches from other major Indian telecom companies like Jio and Vodafone Idea have also been reported, potentially exposing personal data to risks such as identity theft and financial fraud. Despite Airtel’s denial, ensuring cybersecurity best practices, including updating passwords, monitoring accounts for unauthorized activities, enabling two-factor authentication, and avoiding phishing attempts, remains crucial for individuals’ data protection.
Post Your Comments