What’s the news: Just days after the news about Railways Ministry’s plan to monetise public Wi-Fi footfalls data, Rail Yatri, a train ticketing platform, confirmed a data breach that occurred in December 2022, reported The Hindu. As per the report, the confirmation came on January 4, 2023, days following the Ministry’s denial that user data leaked from the Railways’ side was sold on the dark web. Users’ personal data accessed: As per a Rail Yatri spokesperson speaking to the newspaper, the platform noticed the security breach on December 28, 2022. Although the issue was fixed within hours, officials said information regarding some Rail Yatri users’ age, email, preference city and phone numbers “may have been viewed by unauthorised individuals.” Then why did the Ministry deny a breach? To put it simply, the Railway board denied any data stolen from the Indian Railway Catering and Tourism Corporation or IRCTC (emphasis added). It did not mention reselling platforms like Rail Yatri in its statement. Instead, it asked platforms to evaluate their systems which led to this discovery. Has such a breach occurred before? Sadly, yes. Back in 2020, RailYatri suffered a similar breach wherein 7,00,000 users were affected as per the Safety Detectives, a portal run by security researchers and privacy experts. Readers will also remember the AIIMS ransomware attack wherein hackers demanded ₹ 200 crore worth of cryptocurrency for the data of 2-3 crore people. Incidents like these may sometimes raise the question of why private companies are working with government…
