NEW DELHI — The Ministry of Road Transport and Highways has initiated an extensive cybersecurity review following reports that vehicle owners’ personal data was allegedly being sold across mobile applications, websites, and Telegram channels. In response to the potential exposure, the Ministry has directed the Indian Computer Emergency Response Team, known as CERT-In, to perform forensic security audits across four major transport platforms: VAHAN, SARATHI, e-Challan, and PUCC. These repositories manage critical public records spanning vehicle registrations, driver licensing, traffic penalties, and pollution certification. Alongside technical audits, the Ministry is reviewing its current data-sharing framework in collaboration with the Ministry of Electronics and Information Technology to prevent unauthorized access and protect citizens’ sensitive records under the Digital Personal Data Protection Act, 2023.
Unauthorized Data Access via Messaging Channels and Mobile Apps
The regulatory action follows findings indicating that vehicle registration numbers alone could be entered on unauthorized digital channels to yield extensive personal information, in some cases for nominal fees as low as ₹5. A cybersecurity inquiry uncovered a Telegram channel offering comprehensive records, including a vehicle owner’s full name, father’s name, residential and permanent addresses, postal PIN code, and mobile phone number. The channel also allegedly distributed driving licence records, challan records, FASTag details, and downloadable registration certificates alongside PDF copies of physical licences.
Two widely downloaded applications, Vehicle Information App with 10 million downloads and VehicleSetu—RC & Challan Info with approximately one million downloads, were also highlighted during the investigation. While high download numbers do not alone confirm unlawful conduct, their scale has intensified administrative concerns regarding data acquisition channels. In response, the Ministry has approached major digital application storefront operators, including Google, requesting the removal of applications linked to the illicit display of vehicle owner details.
Scrutiny Over Commercial Access Credentials and Search Volumes
Public records obtained through a Right to Information application revealed that 25,314 private corporate entities held active system credentials allowing access to VAHAN, SARATHI, e-Challan, and PUCC databases. These external entities conducted a combined 1.708 crore data searches over a 33-month timeframe, raising urgent questions about whether commercial usage limits and systemic oversight measures were adequately maintained.
Data from the central National Transport Repository is distributed to external parties through application programming interfaces and secure login portals utilizing secret keys, two-factor authentication, and one-time passwords authenticated through Aadhaar. While security protocols require user credentials to mask personally identifiable information for non-security agencies and mandate CERT-In compliance certifications, officials are auditing enforcement agencies and corporate users to verify whether daily search caps and usage policies were strictly honored.
Forensic Inquiries into Logistics Platform Traffic and Triangulation
Preliminary government inquiries have also detected potential data anomalies within the Unified Logistics Interface Platform, managed by the National Industrial Corridor Development Corporation. System monitoring revealed unusually heavy query volumes, with certain authorized entities logging over five million transactions within a single month. The Ministry has directed the National Informatics Centre to audit these access patterns to ensure operations strictly complied with authorized commercial purposes.
Authorities suspect third parties may have combined data harvested from separate public portals to build comprehensive individual profiles, creating severe privacy risks through data triangulation. To tighten oversight, requests from government bodies seeking information via the logistics platform will now require personal authorization from the Transport Secretary alongside identity verification through digital signature certificates or video-based procedures. Ministry officials noted that while safeguards are being strengthened, controlled private access will continue to support commercial efficiency.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
