What potential impact does it have on the security and privacy of people affected?[.c-hand][.c-hand]

[.c-mb-40]This is extremely sensitive data which is usually the base information needed for many malicious attacks against individuals and organisations. And we ourself have found CDSL exposing that level of sensitive data of ~4.39 crore investors, twice. Though there is an indefinite number of possible malicious use cases for such highly sensitive data of millions of people, below are few to give people an idea.[.c-mb-40]

[.c-text-bg-pink]1.[.c-text-bg-pink] The information exposed by CDSL could be a virtual gold mine also for phishers and scammers involved:

[.c-row-flex][.c-box-pink]“Phishing is a form of fraud in which an attacker masquerades as a reputable entity or person in email or other forms of communication.” — SearchSecurity[.c-box-pink][.c-text-column][.c-text-column][.c-row-flex]

1. in so-called Business Email Compromise (BEC) scams, which often impersonate brokers, banks, and businesses in a bid to trick individuals and companies into transferring funds to fraudsters. According to the FBI, BEC scams are the most costly form of cybercrime today.

2. in scams, extortion calls to filtered individuals based on their financials from this exposed data.

3. in scam calls pretending to be from the victim's bank or Income Tax Department or some other institution and getting the victims to trust by telling them their sensitive personal and financial details being exposed from this vulnerability.
‍
4. in income tax refund scams.

‍

[.c-mb-40]Armed with such access to CDSL KYC data, phishers and scammers would have an endless supply of compelling scamming templates for calls and emails to use. A database like this would also give fraudsters a constant feed of new investors getting KYC to target them.[.c-mb-40]

[.c-text-bg-pink]2.[.c-text-bg-pink] Also, there is a possibility of malicious people as part of identity theft, open bank accounts, take loans, and similar using this exposed data. In market securities KYC (of which data was being exposed), people have to give much more information than any other type of KYC.

‍

[.c-text-bg-pink]3.[.c-text-bg-pink] This data can be used to disrupt the Indian share market. It’s a gold mine for malicious attackers looking to spread misinformation to manipulate Indian share markets. There are malicious actors always actively trying to spread misinformation to manipulate markets, but reaching the real investors (essentially, the new investors who are more vulnerable to misinformation) also including high-net-worth investors is a hurdle, but with access to such data of investors, they can disrupt and manipulate the share markets much more efficiently. This data can also be used by enemy countries to disrupt Indian markets.

‍

[.c-text-bg-pink]4.[.c-text-bg-pink] People commonly use the type of information been exposed here as their passwords and security questions to services. That’s why it can also lead to people’s social media, emails, and other accounts being hacked by malicious attackers using their information from this expose.

‍

[.c-text-bg-pink]5.[.c-text-bg-pink] Such sensitive personal and financial data expose of massive numbers of people easily leads to things like financial fraud, identity theft, and exposing people to things like extortion, targeted attacks against people, etc. An attacker can also possibly use this sensitive information to attack investors Demat accounts that hold mutual funds, equity shares, etc. The type of data being exposed is also used for secret questions for multiple services like net banking and verification on call for executing trades on many brokers.

‍

[.c-text-bg-pink]For years,[.c-text-bg-pink] governments have been imposing hefty fines on companies for exposing and leaking customer data worldwide. But in India, there has not been any such significant example. Under the GDPR law of the European Union, even when a company clearly didn’t take reasonable security steps to secure sensitive data, the companies got hefty fines.

Some prominent past incidents of such fines:

[.c-row-flex][.c-box-pink]“In July 2019, Equifax settled a lawsuit stemming from its 2017 data breach, which exposed the personal information of 147 million people. Under the settlement with the FTC, CFPB and state attorneys general, Equifax has agreed to spend up to $425 million to help people affected by the data breach.” — Source[.c-box-pink][.c-text-column][.c-text-column][.c-row-flex]

‍

Under GDPR law, famously British Airways and Marriott have all received fines over €10,000,000 for GDPR violations where they exposed customer data and were fined for insufficient technical and organisational measures to ensure information security (similar to CDSL). You can see other fines made under GDPR privacy law for cyber security negligence here.