PERSONALLY IDENTIFIABLE INFORMATION

Disclaimer: Copyright infringement not intended.

Context

• Recently, the Ministry of Corporate Affairs fixed a critical vulnerability in its online portal months after a cybersecurity researcher reported it to the Computer Emergency Response Team of India (CERT-In).
• The vulnerability reportedly exposed personal details — like Aadhaar, PAN, voter identity, passport, date of birth, contact number and address — of more than 98 lakh directors of Indian companies.

Details

• Personally identifiable information (PII) is any data or information maintained by an organization or agency that can potentially be used to identify a specific individual.
• This includes sensitive details such as Aadhaar, PAN, voter identity, passport, date of birth, contact number, communication address, and biometric information.

Types of PII:

• Basic Identifiers: Names, addresses, phone numbers, email addresses, and Social Security numbers.
• Biometric Data: Fingerprints, facial recognition data, iris scans, and voiceprints.
• Financial Information: Credit card numbers, bank account details, and transaction history.
• Health Information: Medical records, insurance information, and genetic data.
• Online Identifiers: IP addresses, device identifiers, cookies, and user IDs.

Protecting PII is crucial due to the following reasons:

• Privacy Preservation: Safeguarding PII helps uphold individuals' privacy rights and prevents unauthorized access to sensitive personal data.
• Identity Theft Prevention: Compromised PII can be exploited by malicious actors to perpetrate identity theft, leading to financial loss and reputational damage for the affected individuals.
• Prevention of Targeted Attacks: Threat actors can misuse exposed PII to launch targeted attacks on individuals, ranging from phishing scams to fraudulent financial transactions.
• Trust and Confidence: Organizations entrusted with handling PII must demonstrate their commitment to data protection to maintain the trust and confidence of their customers, stakeholders, and the public.

Risks Associated with PII Exposure:

• Cyberattacks and Data Breaches: Weaknesses in digital infrastructure and cybersecurity vulnerabilities can lead to the exposure of citizens' PII, making them vulnerable to data breaches and cyberattacks.
• Fraudulent Activities: Exposed PII can be used by threat actors to engage in various fraudulent activities, including opening unauthorized bank accounts, obtaining credit cards, and compromising digital accounts.
• Sale of PII on the Dark Web: Threat actors may sell exposed PII on the dark web, exacerbating the risks of identity theft and financial exploitation for affected individuals.

Recent events where personally identifiable information (PII) was compromised include:

• Telegram Bot Data Leak (2023):
  • Reports emerged in 2023 that a bot on the messaging platform Telegram was returning the personal data of Indian citizens who registered with the COVID-19 vaccine intelligence network (CoWIN) portal for vaccination purposes.
  • This breach exposed sensitive information of individuals who had registered for vaccination, raising concerns about privacy and data security.
• Dark Web Sale of PII (2023):
  • An American cybersecurity company reported that the PII of 815 million Indian citizens, including Aadhaar numbers and passport details, was being sold on the dark web.
  • The compromised data included highly sensitive personal information, highlighting the risks of large-scale data breaches and the underground trade in stolen PII.
• Government Investigation and Arrests:
  • Following the reports of data breaches, the government of India launched an investigation into the allegations.
  • This investigation led to the arrest of a man in Bihar, along with a juvenile in June 2023, in connection with the data breaches and illegal activities related to the compromised PII.
• Data Breach in RailYatri Platform (January 2023):
  • A data breach was reported in the RailYatri platform in January 2023, exposing the personal information of users.
  • The breach raised concerns about the security measures employed by online platforms and the protection of user data.
• Increase in Cyberattacks:
  • According to a report from Resecurity, 67% of Indian government and essential services organizations experienced over a 50% increase in disruptive cyberattacks.
  • Additionally, a survey of 200 IT decision-makers noted that 45% of Indian businesses experienced more than a 50% increase in cyberattacks.
  • These findings underscore the growing threat landscape and the need for enhanced cybersecurity measures to protect against data breaches and malicious activities targeting PII.

Protection Measures for PII:

• Use of Secure Connections: Individuals should look for HTTPS in URLs when accessing websites and use secure connections to safeguard their PII from interception by unauthorized parties.
• Utilization of VPNs: Virtual Private Networks (VPNs) can help individuals secure their online connections, especially when accessing sensitive information over public networks, thereby protecting their PII from eavesdropping.
• Vigilance and Awareness: Maintaining awareness of potential threats, such as phishing attacks, and being cautious about sharing personal information online can mitigate the risks associated with PII exposure.
• Monitoring Financial Activities: Regular monitoring of bank account transactions, credit cards, and credit scores can help individuals detect any suspicious activities indicating misuse of their PII.
• Encryption: Encrypting PII both in transit and at rest helps prevent unauthorized access or interception of sensitive data.
• Access Controls: Implementing access controls and user authentication mechanisms ensures that only authorized individuals can access PII.
• Data Minimization: Collect and retain only the PII necessary for legitimate business purposes, and securely dispose of data that is no longer needed.
• Anonymization and Pseudonymization: Anonymizing or pseudonymizing PII reduces the risk of identification while still allowing for data analysis and processing.
• Security Awareness Training: Educating employees and users about the importance of protecting PII and recognizing potential security threats helps mitigate risks.

Conclusion

The protection of personally identifiable information is paramount in the digital age, given the prevalence of cyber threats and the potential consequences of PII exposure. By implementing robust security measures, raising awareness about cybersecurity best practices, and fostering a culture of data protection, individuals and organizations can mitigate risks and safeguard sensitive personal data from exploitation.