Breaches and incidents
Income Tax e-Filing portal (India): IDOR let logged-in users view other taxpayers’ data including Aadhaar and bank details
TechCrunch reported a flaw found in September 2025 by researchers Akshay CS and “Viral”.
- Disclosed
- Verification
- Reported by a reputable outlet, citing the company
What happened
- TechCrunch reported a flaw found in September 2025 by researchers Akshay CS and “Viral”: changing the PAN in a request during page load returned another person’s names, addresses, email, DOB, phone numbers, bank account details and Aadhaar numbers, including for people who had not yet filed.
- Root cause: insecure direct object reference; the back end did not check that the requester owned the PAN.
- Attacker: none known; reported to CERT-In.
- Response: a CERT-In representative said on 30 Sep the department was working on a fix; researchers confirmed it fixed by 2 Oct. It is unknown whether anyone abused it.