Quick Answer

In October 2023, cybersecurity firm Resecurity reported that a threat actor advertised a dataset allegedly containing 815 million Indian identity records on a cybercrime forum, shedding light on an Aadhar data breach. The listing reportedly included names, contact details, Aadhaar numbers, and passport information, but the source of the dataset was not conclusively established. The figure referred to records advertised for sale, not 815 million independently verified individuals. This incident highlights why businesses need clear data ownership, limited retention, tested incident response, and documented security safeguards as India phases in its DPDP Act.

Aadhaar is a 12-digit unique identification number that the Unique Identification Authority of India (UIDAI) issues to residents of India. The programme began in 2009, UIDAI issued the first number on 29 September 2010, and the Aadhaar Act of 2016 gave it statutory backing. Each number links to demographic and biometric data, which lets banks, telecom providers, and government schemes verify identity online. The closest US equivalent is the Social Security Number, although Aadhaar adds biometric checks. As of September 2025, UIDAI had generated 142.76 crore numbers, roughly 1.43 billion, the largest biometric ID system in the world. The Aadhaar data breach numbers, however, does not translate to a breach of UIDAI's central database.

CertPro compliance audit meeting scheduling with independent auditors
TL;DR

Concern

Businesses hold identity data across CRM tools, vendors, and spreadsheets without clear owners. The Aadhaar reports left the source of the data unclear, and some identity details stay with a person for life. Late detection and slow reporting add legal risk. The DPDP Act sets penalty ceilings of up to INR 250 crore for weak safeguards once its security provisions apply.

Overview

A seller offered records in October 2023, and Resecurity said a sample appeared valid. Press reports raised a possible link to COVID-19 testing data, which remains a reported possibility. The DPDP Rules, notified in November 2025, phase in obligations, and the breach-intimation rules take effect in May 2027. CERT-In already requires reports within six hours.

Solution

Map your datasets and name an owner for each. Limit collection and delete data when its purpose ends. Review access and monitor large exports. Assess vendors before onboarding. Write an incident plan that separates CERT-In duties from DPDP duties, then test it. Keep access reviews, alerts, and incident tickets, because auditors judge controls by evidence. An independent SOC 2 examination can test those controls.

How the Aadhaar Breach Unfolded

  • 9 October 2023: A seller using the alias "pwn0001" reportedly advertised 815 million records linked to Indian citizens on a cybercrime forum.
  • Late October 2023: Resecurity published its findings and described checks on a sample of the data.
  • 31 October 2023: NDTV reported that CERT-In was investigating reports of an alleged large-scale exposure. Reporting also raised a possible link to COVID-19-era data, but the dataset's exact source remained unconfirmed.

What Was Reported in the Aadhaar Data Leak?

The advertised fields reportedly included Aadhaar numbers, names, phone numbers, addresses, and passport-related details. The claimed 815 million records should not be interpreted as 815 million confirmed, distinct affected individuals: the complete dataset and its origin were not independently verified. Three points matter to businesses.

  • Identity data carries lasting risk

    A password resets in minutes, yet some identity attributes stay with a person for life.

  • Custody stayed unclear

    The source of the dataset remains uncertain, so no one should name an organization as deficient on the strength of a listing.

  • Verification raised concern

    Resecurity reported that sample records appeared valid. However, this does not establish that every advertised record was authentic or subsequently misused.

Potential Data Protection Gaps Highlighted by the Aadhaar Reports

The source of the dataset remains uncertain, so these gaps are risk areas the case helps businesses examine, not confirmed findings.

  • Data ownership

    Name the team accountable for each personal-data dataset and its approved uses.

  • Inventory and access

    Know where sensitive data sits, who can access it, and who monitors exports. CertPro's analysis of the biggest data breaches covers a 2018 Aadhaar access claim that raised similar questions about credentials and permissions.

  • Retention

    Document why you keep data and apply lawful disposal schedules.

  • Third parties

    Assess contracts, access permissions, and escalation routes for vendors and processors.

  • Detection and response

    Investigate unusual access quickly and preserve evidence for reporting

Infographic of the Aadhaar data breach reports and the data protection gaps they highlight: data ownership, inventory and access, retention, third parties, and detection and response
Potential Data Protection Gaps

What the DPDP Act Means for Indian Businesses

The Digital Personal Data Protection (DPDP) Act, 2023 sets duties for Data Fiduciaries, the entities that decide why and how personal data is processed. The government published the commencement notification and the DPDP Rules, in November 2025, and the rollout is phased. As of November 2026, the core security and breach-intimation provisions are scheduled for May 2027, so businesses should not present them as fully enforceable today.

The Act provides maximum penalties of up to INR 250 crore for failing to take reasonable security safeguards and up to INR 200 crore for failing to notify a breach, once the relevant provisions apply. These are statutory ceilings, not automatic fines for every incident.

CERT-In and DPDP reporting are different obligations. Read the CERT-In Directions and its FAQs alongside the official DPDP Rules, 2025.

  • CERT-In directions

    Reporting position: Certain specified cyber incidents, including qualifying data breaches or leaks, must be reported within six hours of noticing or being brought to notice.
    Important distinction: The 2022 directions are already applicable; assess whether the incident falls within their reporting scope.

  • DPDP Act and Rules

    Reporting position: Once applicable, a Data Fiduciary must notify affected Data Principals and the Board; the Rules provide for prompt Board intimation and a detailed update within 72 hours, unless extended.
    Important distinction: The relevant DPDP breach-notification provisions are scheduled to commence in May 2027.

A single event may engage different legal or sector-specific duties. Organizations should verify the applicable rules and seek qualified legal advice where needed.

Lessons Indian Businesses Take From the Aadhaar Breach

The Aadhaar reports give Indian businesses five practical lessons, and each ties to evidence that an auditor or regulator can test.

  • 1. Maintain a personal-data inventory.

    Record the categories of data, purpose, storage location, authorized users, retention basis, and owner. Update the inventory when systems or vendors change.

  • 2. Limit collection and retention.

    Collect only what a defined purpose needs. Delete or de-identify data when the business no longer needs it, subject to legal holds, and keep disposal logs.

  • 3. Test incident detection and reporting.

    Define who escalates, who assesses reportability, and how the team preserves evidence. Separate CERT-In duties already in force from DPDP duties that start later.

  • 4. Strengthen third-party oversight.

    Keep a register of vendors that process personal data, with access limits, security duties, and notification channels. Review it when processing changes.

  • 5. Preserve evidence of control operation.

    Policies describe intent, while access approvals, reviews, alerts, retention logs, vendor evaluations, and incident tickets show practice.

Evidence Independent Auditors Look For

An auditor evaluates whether controls exist, whether they operate, and whether records prove it. The Aadhaar gaps map to six evidence areas:

  • Data inventory and ownership

    Examples of evidence: Approved data register, system inventory, assigned owners

  • Access management

    Examples of evidence: Provisioning and removal tickets, periodic access review records

  • Retention and disposal

    Examples of evidence: Retention schedule, deletion approvals and execution logs

  • Monitoring

    Examples of evidence: Relevant event logs, alert investigations and escalation records

  • Vendor oversight

    Examples of evidence: Vendor register, contracts and documented security reviews

  • Incident response

    Examples of evidence: Response plan, tabletop records, incident tickets and post-incident reviews

How CertPro Supports Independent SOC 2 Examinations

An independent examination can assess controls against defined criteria and within an agreed scope. CertPro CPA LLC is an independent, licensed CPA firm that performs independent SOC 2 examinations under applicable AICPA standards. A SOC 2 Type 1 report addresses the design of controls at a specified date; a Type 2 report also addresses their operating effectiveness over a specified period. Neither report guarantees that breaches cannot occur, and SOC 2 is not a substitute for compliance with Indian law.

Organizations evaluating an independent SOC 2 examination can schedule a meeting to discuss the proposed scope and engagement requirements.

Frequently Asked Questions
The reported 815-million-record listing does not, on its own, establish that UIDAI's central Aadhaar database was breached. The precise source of the advertised records should not be stated as confirmed without authoritative evidence.
Applicability depends on the nature of the digital personal-data processing and the Act's scope, exemptions and commencement provisions. Businesses should assess their activities rather than assume that every provision applies immediately.
No. SOC 2 addresses controls within a defined examination scope against the applicable Trust Services Criteria. It does not certify compliance with the DPDP Act or replace statutory obligations.
Contain the incident, preserve evidence, and assess whether it falls within CERT-In's reporting scope, which already applies. Report qualifying incidents within six hours of noticing them. DPDP breach-notification duties commence in May 2027, so plan for them now.
Once the relevant provisions apply, the Data Fiduciary remains responsible for personal data that a Data Processor handles on its behalf, including taking reasonable security safeguards. Businesses should document vendor contracts, access limits, and escalation routes.