After suffering a data breach in 2020 when personal data of around 90 lakh railways ticket buyers was compromised, it seems that a similar case may have happened again with IRCTC. Reportedly, data of three crore railway travellers has been stolen online and put up for sale on dark web. The theft is said to have happened on December 27.

As per the reports, the data has been manhandled by a forum being run by cybercriminals that has access to very private data of users booking tickets from IRCTC portal in the recent past few months. The stolen data includes private information like usernames, emails, mobile numbers, gender, full address, and user’s language preferences.

IRCTC has, however, denied the reports claiming that the sample data does not match with the IRCTC’s history API and no such data breach has occurred.

“An incident regarding Indian Railway data breach has been reported in the media. In this connection it may be submitted that Railway Board had shared a possible data breach incident alert of CERT-In to IRCTC reporting a data breach pertaining to Indian Railways passengers. On analysis of sample data it is found that the sample data key pattern does not match with IRCTC history API. Reported/suspected data breach is not from the IRCTC servers,” ANI quoted the statement issued by the railway ministry on Wednesday.

“Further Investigation on the data breach is being done by IRCTC. All IRCTC Business Partners have been asked to immediately examine whether there is any data leakage from their end and apprise the results along with corrective measures taken to IRCTC,” it further added.

This comes after recently it was reported that the servers of AIIMS Delhi were hacked by a China-based hacker. It is claimed that hackers gained access to five out of the forty physical servers putting private data of nearly 4 crore patients at risk.

ALSO READ | Under cyber attack: The AIIMS ransomware attack is just a reminder how vulnerable organisations can be

ALSO READ | Cybersecurity in 2022: From AIIMS to Twitter and Rockstar Games, biggest data breaches reported this year