EPFO says Aadhaar data is safe

BENGALURU: The Employees' Provident Fund Organisation (EPFO) on Wednesday claimed that there has been no leak of Aadhaar data from its servers, contradicting a leaked letter online of its chief provident fund commissioner VP Joy, who had ordered a technical team to plug leaks on a site that allowed users to link their unique identity numbers with their provident fund (PF) numbers.

Joy’s letter dated March 23 and marked “secret” and addressed to Dinesh Tyagi, CEO of Common Service Centre surfaced online, which claimed that hackers exploited vulnerabilities of aadhaar.epfoservices.com, to steal data. The letter claimed that these hackers accessed the data through ‘strut vulnerability’ and ‘backdoor shells’ and cited an intelligence bureau alert a day earlier on the issue.

“In this regard, it is informed that warnings regarding vulnerabilities in data or software is a routine administrative process based on which the services which were rendered through Common Service Centres have been discontinued w.e.f. March 22, 2018. The news is relating to the services through common service centres and not about EPFO Software or data centre. No confirmed data leakage has been established or observed so far,” it said.


EPFO adds that it will continue to take all precautions and measures to ensure that no data leakage takes place and be vigilant about it in future. EPFO has taken advance action by closing the server and host service through Common Service Centres pending vulnerability checks as part of data security and protection. EPFO has been taking all necessary precautions and measures to ensure that no data leakage takes place, it said.

A senior official of the ministry of electronics and IT said: “Based on my knowledge it was a security audited site, but if a vulnerability has been pointed out, exercise will be taken to plug that vulnerability, and we will look into it.” The official added that the government continuously conducts exercises to identify security gaps in government websites.

UIDAI distanced itself from the controversy saying the website where the leak happened does not belong to UIDAI in any manner whatsoever. “This matter does not pertain at all to any Aadhaar data breach from UIDAI servers. There is absolutely no breach into Aadhaar database of UIDAI. Aadhaar data remains safe and secure,” it said.