Indian securities depository exposed 44 million investors' personal info – twice

guest · Nov 9, 2021

Indian securities depository exposed 44 million investors' personal info – twice
Didn't act until CERT stepped in and pointed out problems
November 9, 2021
https://www.theregister.com/2021/11/09/cdsl_data_leak/

Indian infosec consultancy CyberX9 claims it twice found records of 43.9 million shareholders exposed by systems operated by Central Depository Services Limited (CDSL) – and that the depository company responded slowly to its alerts of significant vulnerabilities.

CDSL bills itself as a crucial player in India's financial markets. It serves exchanges, investors, and issuers with depository services – electronic records of investors and their shareholdings. The company claims to have almost a million customers.
Click to expand...

CyberX9 has alleged that CDSL exposed data describing even more customers, with full names, tax department ID numbers, marital status, date of birth, nationality, residential address, email address, occupation details, and even the names of spouses and parents leaked.

"The vulnerability wasn't highly complex for our team to discover," states CyberX9's initial post.
A subsequent post detailing a second data leak describes it with a subhead that reads "Horribly poor level of cyber security + Sheer negligence = Very Bad" and again claims the vulnerability was not hard to discover.
Click to expand...

CyberX9 further alleges that it informed CERT-In and India's National Critical Information Infrastructure Protection Centre of both hacks, and that CDSL only acted after those bodies requested remediation.
Click to expand...

Log in or Sign up

Indian securities depository exposed 44 million investors' personal info – twice

guest Guest

Log in or Sign up

Indian securities depository exposed 44 million investors' personal info – twice

guest Guest

Useful Searches