Cybersecurity Firm Says CoWIN Portal, Backend Database Not Compromised

After the Union health ministry dismissed reports of a data breach on the CoWIN platform, cyber security firm CloudSEK has said that threat actors do not have access to the entire portal nor the backend database.

“Based on matching fields from Telegram data and previously reported incidents affecting health workers of a region, we assume the information was scraped through these compromised credentials,” CloudSEK said in a report on Monday after an independent analysis.

On March 13, a threat actor on a Russian cybercrime forum advertised for compromised access on the CoWIN portal of the Tamil Nadu region, it said. 

After an analysis, CloudSEK said, it was discovered the breach was that of a health worker and not really of the infrastructure. The content displayed on the screenshot matches with the Telegram bot mentioned in the media as follows — the name of the individual, mobile number, identity proof, identification number, and the number of doses completed.

“Furthermore, there are numerous healthcare worker credentials accessible on the dark web for the CoWIN portal. However, this issue primarily stems from the inadequate endpoint security measures implemented for healthcare workers, rather than any inherent weaknesses in CoWIN’s infrastructure security,” the report said.

Asserting that the CoWIN portal was completely safe with adequate safeguards for data privacy, the Union health ministry on Monday dismissed as “mischievous” the claims of a data breach on the platform and said the matter had been reviewed by the country’s nodal cyber security agency CERT-In.

In a statement, the ministry also said that an internal exercise had been initiated to review the existing security measures.

“With reference to some alleged CoWIN data breaches reported on social media… the Indian Computer Emergency Response Team (CERT-In) immediately responded and it does not appear that the CoWin app or database has been directly breached,” said Union Minister of State for Electronics and Information Technology Rajeev Chandrasekhar.

In its statement, the health ministry said there was no basis for the reports alleging the breach of data from the CoWIN portal, a repository of all data of all those who have been vaccinated against COVID-19 in the country.

“It is clarified that all such reports are without any basis and mischievous. The Co-WIN portal of the health ministry is completely safe with adequate safeguards for data privacy,” it had said.

CERT-In, in its initial report, has pointed out that the backend database for the Telegram bot was not directly accessing the APIs of the CoWIN database, according to the statement.