Breaches and incidents
IIT Roorkee / JEE (Advanced) 2026 (India): results storage bucket exposed result records and admit cards
Researcher Rylen Anil (16) reported on X that a public cloud storage endpoint for the JEE (Advanced) 2026 results portal was readable without...
- Disclosed
- Verification
- Reported by a reputable outlet, citing the company
What happened
- Researcher Rylen Anil (16) reported on X that a public cloud storage endpoint for the JEE (Advanced) 2026 results portal was readable without authentication, with about 179,600 result records and 187,300 admit-card PDFs (names, dates of birth, mobile numbers) (ETV Bharat).
- Root cause: cloud storage misconfiguration that IIT Roorkee says followed “technical interventions on June 2”.
- Attacker: none; responsible disclosure.
- Response: IIT Roorkee thanked the researcher, said “The data stored was read-only” and the issue was plugged; on 5 Jun it called breach claims “misleading”, said “no sensitive information was compromised or mass-extracted” and that access was limited to under 0.05% of data.