Govt denies data breach of 7 million BHIM users, cybersecurity firm maintains its claim

The National Payments Corporation of India (NPCI) has issued a statement saying there has been no compromise of data on the BHIM app, after Israeli cybersecurity firm vpnMentor’s claims that it had discovered a breach of personal records of around 7 million Indians used to onboard them to the mobile payment app. As per the report, the data was stored on a misconfigured Amazon Web Services S3 bucket and was publicly accessible.

The breach was discovered by Noam Rotem and Ran Locar of the vpnMentor research team who say the exposed records are highly sensitive as it includes many documents needed to open an account on BHIM.