For 33 months, outside organisations could read India’s national vehicle registries at industrial volume. A Right to Information reply obtained by the Internet Freedom Foundation puts the total at nearly 17 million queries between January 2024 and September 2026.
The National Informatics Centre, which runs the systems, said it issued 25,314 credentials to private entities over that stretch. Its answer also logged 338 private credentials against 62 for government bodies, a gap it did not explain.
Access ended on October 1, when New Delhi suspended private data sharing across VAHAN, SARATHI and the linked transport systems. The numbers only became public weeks later.
What the credentials bought was cheap. Cyderes spent months inside a commercial brokerage that resold lookups through a Telegram bot and a business API, quoting INR 5 to INR 700 a query. A single plate number yielded family names, both addresses, a mobile number, a Cibil credit score, FASTag balance, insurance policy details, engine and chassis numbers, and PDFs of the registration certificate and licence.
Three licensed vendors’ tokens were in use. The brokerage described 1,793 logged queries and no sign of systematic abuse at scale, while noting that its pipeline could address any plate a buyer could see. India has more than 350 million registered vehicles.
