Sai Krishna Kothapalli, a security expert and founder of cybersecurity startup Hackrew, claimed that he found 3,202 Indian government email IDs and their passwords leaked on the dark web across multiple databases.
According to Kothapalli, the exposed email accounts belong to key officials from around 20 different government institutions and ministries, including Indian Space Research Organization (ISRO), Bhabha Atomic Research Centre (BARC), Securities and Exchanges Board of India (SEBI), and Indira Gandhi Atomic Research Center (IGARC).
Senior government officials including former and current ambassadors, serving and retired scientists in ISRO, and senior bureaucrats across state governments, especially scientists working in nuclear technology are being targeted via phishing emails. It’s said that the exposed emails on the dark web are with “gov.in” extension.
As per Kothapally’s research findings, 365 e-mail accounts are leaked from IGARC, which is the highest number in the breach. Whereas, 325 e-mail credentials from BARC have become public, followed by 157 from SEBI.
“I’m in the process of finishing the remaining investigation and contacting the respective government organizations to alert them on this issue. It is not just government organizations, but the details of the employees of several multinational companies, Indian companies, etc. have also been leaked. At this stage, it is important to be proactive, revoke those credentials and take proper security measures. It is high time that two-factor authentication is introduced to access email accounts of employees in sensitive organizations. Another simple measure that will prevent damage from future attacks is to use a password manager and set separate passwords for various web-based services,” Kothapalli said in a media statement.
Earlier, a similar research by hardware networking firm, Cisco revealed that one in three Indian organizations faced huge financial losses from security breaches.
The research, “2019 Asia Pacific CISO Benchmark Study”, disclosed that nearly 37 percent of organizations in India suffered downtime of over nine hours after a data breach. Around 46 percent of companies surveyed stated that they’ve received more than 5,000 threat alerts in a day, in which 43 percent of them went unattended. The survey findings were based on responses from 2,000 security leaders across 11 countries in the Asia Pacific, from public and private organizations.
