Story ·

Vehicle owners' details for ₹5: what is known about the Vahan and Sarathi data sale

Researchers say a person’s name, father’s name, home address and phone number can be bought from a Telegram bot for ₹5, starting from nothing but a vehicle registration number. On 24 October the road transport ministry was reported to have ordered a CERT-In audit of four of its portals. Here is what is confirmed, what is only reported, and what the government’s own numbers show.

By Threat Atlas India · Published 25 October 2026 · This story will be updated if the ministry or CERT-In publishes its findings.

The short version

  • Shown by researchers: security firm Cyderes found a Telegram bot selling Indian personal records, including vehicle owners’ details, from ₹5 a lookup. The Internet Freedom Foundation (IFF) ran one test lookup on a vehicle belonging to a consenting colleague, using a mobile app that charged about ₹1.93 a search. It returned the owner’s full name, father’s name, addresses and policy details.
  • How, according to Cyderes: not by breaking into a government database. The seller used credentials issued to licensed verification companies, without authorisation. Cyderes says it did not confirm that any of those companies was breached.
  • Official figures: in an RTI reply on 16 October, NIC, which runs the Parivahan systems, said private-entity access was stopped from 1 October 2026 on a ministry direction. It also gave query counts (see below).
  • Reported, not confirmed by us: that the ministry has ordered CERT-In forensic audits of VAHAN, SARATHI, e-Challan and PUCC. We found the reports on 24 October, but no statement from the ministry.
  • Not known: how many people’s records were sold, who the buyers were, and whether the access that Cyderes found has now been closed.

What researchers showed, and what officials have said

The sale was described by outside researchers first. The figures below come from the government’s own replies to RTI requests, as published by IFF. We have not seen the replies ourselves.

Shown by researchers ₹5 The price of a vehicle lookup on the Telegram bot Cyderes studied. A backup channel had 21,329 subscribers before the findings were reported. Cyderes says a replacement channel rebuilt by mid-July had about 2,230.
Official RTI reply, 16 October 17.1 million queries to the vehicle database by outside users between January 2024 and September 2026, according to NIC. IFF works that out as roughly 17,000 lookups a day.

Cyderes states plainly that no government database was breached. The access came through credentials issued to licensed intermediaries. That is the researchers’ finding, and we have not seen it confirmed by the government.

How it unfolded

  1. Reported to CERT-In. Cyderes says it told CERT-In and each affected company about the exposed credentials.
  2. Still open. Cyderes says one exposure was still returning full vehicle records, including owners’ mobile numbers.
  3. Cyderes publishes. Its report describes the Telegram bot, a business-facing data marketplace, the prices and the credentials.
  4. IFF’s RTIs. IFF files requests with the ministry and NIC. The ministry’s reply, dated 24 September, answers none of the twelve questions and points to a web page on how to apply for data.
  5. Private access stopped. NIC says private-entity sharing was discontinued from this date on a ministry direction. It gives no reason.
  6. NIC replies. It gives the query counts and credential numbers below.
  7. Audit reported. Two outlets report that the ministry has ordered CERT-In forensic audits of four portals and a review of its data sharing with MeitY. We found no ministry statement.

What the official numbers show

From NIC’s RTI reply

17,079,998 queries from January 2024 to September 2026. 338 credentials recorded for private entities and 62 for government bodies, with 25,314 issued to private entities over the whole period. 28 reported cyber security issues. VAHAN was last audited on 17 December 2025. Logs are kept for one year (API) and six months (SMS).

What IFF reads into them

If 338 is today’s register and 25,314 is the total ever issued, about 25,000 credentials are no longer on it, and NIC gave no revocation figures. Query volumes fell by more than half from mid-2025, without explanation. IFF also says the SMS logs for the period Cyderes studied have probably been deleted already. These are IFF’s reading, not official findings.

Some reports say 25,314 organisations “hold active credentials”. IFF’s reading of NIC’s reply is that this is the cumulative number issued, and that 338 is the current count for private entities.

How the data may be getting out

IFF lists four possible routes, none of them proven. Copies of data sold under a bulk-sharing policy that the government scrapped in 2020. Credentials issued to approved companies that are then resold, shared or misused. Automated scraping of public lookup pages. And stolen or insider credentials at RTOs, NIC or vendors. Cyderes’s findings point to the second: credentials meant for verification companies, used by someone else.

Threat Atlas India does not name private companies that appear only in researchers’ findings. Cyderes names the firms whose credentials were exposed and says it did not confirm any of them was breached.

What to do

  1. Expect targeted scam calls. A caller who knows your name, address and vehicle number is not proof they are from the RTO, police or your insurer.
  2. Check challans only on the official site. Do not pay a fine through a link in a text or on WhatsApp.
  3. Never share an OTP, even if the caller quotes your registration number and chassis number.
  4. If you run an app or service that uses vehicle or identity lookups, use short-lived credentials, keep them out of public code, and log who queries what.
  5. If you are a vehicle owner, there is no official way yet to find out whether your record was sold. IFF has asked the ministry to create one.

What we don’t know yet

  • How many people’s records were sold, and to whom.
  • Whether the ministry has confirmed the audit, and what the audit covers.
  • Whether the exposed credentials found by Cyderes have all been revoked.
  • Why NIC says private access was stopped on 1 October, and which entities lost it.
  • Whether the 25,314 figure means credentials issued over the period or something else.
  • Whether affected people will be told.

This story sticks to published research and the government’s own RTI replies, as reported by IFF. It will be updated if the ministry or CERT-In says more.

Sources

Spotted an error? Write to [email protected]. See the method and corrections.

More stories

Breaches · 25 October 2026Film censor board documents on more than 500 films were posted online: what is knownThe Hindu reports that scripts, cut orders and distribution contracts tied to more than 500 films filed with India's film censor board were downloadable online. The board says it has found no trace of unauthorised access. What is reported, what the board says, and what is unknown.
Breaches · 23 October 2026An AI-assisted hacker took 5,200 records from an Indian university: what the report saysPalo Alto Networks' Unit 42 says an attacker using DeepSeek V4 took a database of more than 5,200 student and faculty records from an Indian public university through a weak admin password. What the report confirms and what it leaves out.
Breaches · 22 October 2026Amagi Media Labs: an extortion claim, what is confirmed and what is only claimedBengaluru media-technology company Amagi told the stock exchanges that a threat actor is trying to extort it over stolen network data. What Amagi confirmed, what a ransomware group lists, and what is still unknown.
All stories →