Meity on alert to find Indian data in global breach; asks Cert-In to probe

Business Standard

20-06-2025

Taking cognizance of an alleged global data breach, the Union government is taking steps to identify the quantum of Indian data in it, it is learnt. In what is being considered one of the biggest breaches globally, user names, passwords, and other sensitive personal information of around 16 billion digital accounts were leaked recently.
The Ministry of Electronics and Information Technology (Meity) has asked the Indian Computer Emergency Response Team (Cert-In) to seek an appropriate response from intermediaries, data centres, corporate bodies, and government organisations on the Indian data present in the global data leak and report back with details.
'Given the proportion of the global leak, it is very likely that the data of Indian citizens might be on the dataset,'' an official said. Cert-In is looking into it, he pointed out, adding that Indian firms too will have to look into it and report according to cyber incidents norms.
Earlier this week, media reports suggested that data of nearly 16 billion accounts of Apple, Facebook, Google, GitHub, Telegram, and various government services were leaked.
A Cybernews researcher team, led by Vilius Petkauskas, found, through an investigation beginning in January 2025, that the new records were scattered across 30 different databases and were most likely stolen by various infostealers.
'The datasets that the team uncovered differ widely. For example, the smallest, named after malicious software, had over 16 million records. Meanwhile, the largest one, most likely related to the Portuguese-speaking population, had over 3.5 billion records. On average, one dataset with exposed credentials had 550 million records,' Cybernews said in a report.
Emails sent to Apple, Meta, Google and Microsoft did not yield any response on whether they had sent any instructions to users on the alleged breach, and if data of Indian users was also found in the said breach.
'While the exact nature of these leaks remains unclear as investigations unfold, the critical takeaway for users and enterprises alike is unequivocal: reactive password resets are no longer enough. Proactive adoption of strong multi-factor authentication (MFA), particularly biometric verification, is now essential. It creates a critical layer of security that stolen credentials alone cannot compromise,' said Vijender Yadav, co-founder and chief executive officer of cybersecurity firm Accops.
In 2022, Meity had issued comprehensive guidelines on the timelines by which any cyber incidents would have to be reported to Cert-In, along with the details of the nature of the attack, the systems, the quantum of data compromised, and whether the users had been informed about the compromise of the datasets.
As per the norms then issued, the ministry had also mandated that all companies should maintain a 180-day rolling log of all of their information technology and computer systems and keep that data within India. As and when demanded by Cert-In, this data would have to be furnished in cases of cyber incidents.