India’s Ministry of Road Transport and Highways has handed its four largest vehicle-data portals to the national computer emergency response team for a forensic security audit. CERT-In will examine VAHAN, which holds registration records, SARATHI, which holds driving licences, e-Challan, which tracks fines, and PUCC, which stores pollution certificates.
The trigger was commercial resale of owner details. Reporting by The Hindu found Telegram channels returning a full name, father’s name, both addresses, PIN code and mobile number in exchange for a registration number, with charges quoted around INR 5 per lookup.
The security firm Cyderes traced how that supply worked. No government system was cracked. Credentials issued to three licensed verification vendors, including SurePass and AuthBridge, were reused to run ordinary queries, so the traffic looked like a paying customer in good standing. One token, minted in February 2024, carried an expiry date of 2044 and authenticated for over seven months before it was revoked.
New Delhi now wants app store operators to pull the lookup apps. The ministry has also asked the electronics and IT ministry to rewrite the data-sharing policy that grants private firms API access, and plans to audit enforcement agencies that log into the same repositories.
The paper trail is thin by design. A query made through a resold token leaves no intrusion to investigate and no anonymous account to chase, only a billing line.
