Cyberabad cops nab man stealing, selling data of 67 crore individuals

'The accused was found selling personal and confidential data of about 66.9 crore individuals and organisations maintained in 104 categories,' a police release said

The Cyberabad police have arrested a person involved in illegal procurement and sale of personal and confidential data pertaining to about 67 crore individuals across the country.

The accused Vinay Bhardwaj was found in possession of data of students of Byjus and Vedantu, of 1.84 lakh cab users in eight metro cities and also data of 4.5 lakh salaried employees of six cities and Gujarat state.

Further, the customer data of organisations like GST, RTO, Amazon, Netflix, Youtube, Paytm, Phonepe, Big Basket, BookMyShow, Instagram, Zomato, Policybazaar, Upstox, etc was also in the possession of Bhardwaj, cops said on Saturday.

Also Read | 'Grim' criminal abuse of ChatGPT is coming, Europol warns

The arrest comes following the apprehension of a gang of offenders in a similar case of data theft a few days back by the Cyberabad police. The gang was stealing and selling sensitive, confidential data of 140 categories, pertaining to government organisations and also personal data of 16.8 crore citizens including information of bank credit-debit card holders, frequent flyers and even NEET students. They were selling the data through Justdial and similar platforms.

In the present case too, the accused was found selling personal and confidential data of about 66.9 crore individuals and organizations maintained in 104 categories.

“The magnitude of data now is four times bigger, which is being used for cyber crimes, unsolicited marketing calls, advertising etc,” Kalmeshwar Shigenavar, DCP Crimes, Cyberabad told DH. “The menace could be bigger. We are probing the matter further.”

Bhardwaj was operating through a website “InspireWebz” at Faridabad, Haryana and selling databases to clients through cloud drive links. “This includes 51.9 crore data of individuals and organisations of 24 states and 8 cities maintained in 44 categories. Some important data held by the accused includes that of defence personnel; government employees; PAN card holders; students data of 9th, 10th, 11 and 12th standard; senior citizens; Delhi electricity consumers; D-MAT account holders; mobile numbers of various individuals; NEET students; high net worth individuals; insurance holders; credit card and debit card holders etc,” said Shigenavar.

Further the database of car owners, job aspirants, NRIs was also found.

The police official said that Bhardwaj had established an office in Faridabad and collected databases from one Amer Sohail and Madan Gopal and was using social media platforms to resell the data to fraudsters for profits. The cops are searching for Sohail and Gopal.

The proposed Digital Personal Data Protection Bill 2022 sets out the rights and duties of the citizen (Digital Nagrik) and obligations of the Data Fiduciary to use collected data lawfully. The bill envisages the setting up of a Data Protection Board of India to determine non-compliance with the provisions of the draft Bill, and impose penalty for such non-compliance.

At present, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, formulated under the Information Technology Act 2000, provide the security practices and procedures that a body corporate or any person collecting, receiving, possessing, storing, dealing or handling information on behalf of the body corporate is required to observe for protecting personal data of users.