Police suspect nexus of people behind data theft in Telangana

The Cyberabad police in Telangana are probing into the possibility of involvement of a vast network of people behind the theft and sale of personal and confidential data of 66.9 crore individuals and organisations from across the country.

On April 1, the Cyberabad police arrested a man, identified as Vinay Bharadwaj, based out of Faridabad in Haryana, who was involved in the data theft of people and organisations spread over 24 states, including eight metropolitan cities in the country and selling them to fraudsters.

Cyberabad police commissioner Stephen Ravindra disclosed that Bharadwaj was found to have gathered the data of even defence personnel, including their personal information such as phone numbers, residential address, email id, date of birth etc.

“We are investigating the sources through which Bhardwaj managed to gather such voluminous data,” Ravindra said.

A senior police official privy to the investigation said on condition of anonymity that it would not be possible for a single person to resort to the theft of such a huge data, but involved a big network of people.

“Inquiries revealed that Bharadwaj worked as an ordinary web designer in the past. But eight months ago, he launched his own website ‘InspireWebz’ for selling the database to his customers through cloud drive. We suspect that it was not his idea alone but there are more people with sound technical knowledge of data theft,” the official said.

The commissioner named two other individuals – Amer Sohail and Madan Gopal, who had allegedly provided the voluminous data to Bhardwaj who sold the data to his clients through his website. Both Sohail and Gopal are absconding.

“We have sought the court to grant the police custody of Bharadwaj for questioning to find out his modus operandi and the actual people behind him. The arrest of two others might also throw some more light on the probe,” the police official quoted above said.

Senior officials of the Cyberabad police, who had a meeting on Monday to study the case, have decided to send special teams to major cities in the country, including Delhi, Gurgaon, Faridabad etc where the data theft is believed to have taken place.

Preliminary investigation revealed that Bharadwaj and his accomplices might have got access to “dark web” to collect the sensitive and personal data of individuals and organisations.

Cyber security expert Nallamothu Sridhar said through the dark web, private computer networks can communicate and conduct business anonymously without divulging identifying information. “Unlike other world-wide webs like Google, dark web has its own network and configuration, which requires authorisation to access information. Bharadwaj appears to have gained access to it using his links,” he said.

The police said Bharadwaj might have acquired data through other means such as hacking the customer and consumer data from e-commerce companies.

The Cyberabad police are also thoroughly examining “Inspirewebz,” the portal launched by Bharadwaj, on the transactions he had made. “It has been designed in such a way that the data is transferred to the client soon after he pays money online. The entire client data appears to be on cloud and we are trying to decipher the same with the help of experts,” the official said.

Soon after the arrest, the Cyberabad police commissioner revealed that Bhardwaj holds consumer and customer data base of GST payers, Road Transport Corporation customers, Amazon, Netflix, YouTube, Paytm, Phonepe, Big Basket, Book My Show, Instagram, Zomato, Policy Bazaar, Upstox, Byjus and Vedantu etc.

The data is classified into 104 different categories including banks, insurance and financial services, doctors, software engineers, telecom, trading & stock broking, consulting services.

“Investigations revealed that Bharadwaj was selling data to his clients for a price ranging from ₹5,000 to ₹1 lakh, depending on the volume of the data and the requirement of clientele,” the official said.

Meanwhile, the Cyberabad police issued notices to as many as 11 companies and organizations through which the accused was believed to have collected the consumer data.

“We are confident of breaking the nation-wide network of these data theft gangs who are operating through call centres and offices set up in different parts of the country. Online advertisement and business portals are used by the gangs to carry out their illegal business,” the official added.