Archive — US — techcrunch
Security bug in India’s income tax portal exposed taxpayers’ sensitive data
A security vulnerability in India's income tax portal exposed sensitive taxpayer data, including personal and financial information. Discovered by researchers in September, the flaw allowed logged-in users to access anyone's data by manipulating their Permanent Account Number (PAN). The issue was fixed by October 2, 2023, but concerns about potential data breaches raise significant security implications.
Key points
- The vulnerability was found by security researchers during tax filing.
- It allowed access to sensitive data of other users by altering the PAN during a session.
- Data exposed included names, addresses, Aadhaar numbers, and financial details.
- The flaw was an insecure direct object reference (IDOR), a common security issue.
- CERT-In alerted to the issue, but its timeline for fixing was undefined.
- The number of potentially impacted users is unclear, with over 135 million registered.
Why it matters
- This incident reflects broader cybersecurity concerns emphasized in 2025 IT trends, such as increased vulnerability to data breaches.
- Government agencies worldwide face scrutiny over public data protection amid rising cyber threats.
- The exposure highlights the importance of robust security measures in digital government services, critical as more citizens engage online.
The exposure of sensitive taxpayer data through a security flaw in India's income tax portal underscores the urgent need for improved cybersecurity practices in government systems, especially as digital services continue to expand.