Breaches and incidents
EPFO (India): pension dashboards exposed pensioners’ data by changing an office code in the URL
Decode (BOOM) reported that researcher Nilabh Rajpooth, browsing archived EPFO pages, found pension dashboards opened by changing a three-digit regional...
- Disclosed
- Verification
- Reported by a reputable outlet, citing the company
What happened
- Decode (BOOM) reported that researcher Nilabh Rajpooth, browsing archived EPFO pages, found pension dashboards opened by changing a three-digit regional office code in the URL, exposing PPO numbers, mobile numbers, full addresses and disbursement dates of pensioners whose payments were stalled; at least 15,000 records in the first finding.
- Root cause: unauthenticated pages keyed on a guessable office code.
- Attacker: none known.
- Response: reported to CERT-In on 25 Dec 2024; EPFO fixed it by 27 Dec 2024. No official statement quoted.