The fragile shield: India's test of data resilience

As breaches multiply worldwide, India must reinforce its fragile shield of digital identity with stronger defences, resilience, and civic trust.

- BY DAVID SEHYEON BAEK

In June 2024, Indonesia's Temporary National Data Centre (PDN 2) was targeted by a ransomware attack that encrypted over 200 public services. The attackers, using a LockBit 3.0 variant known as Brain Cipher, demanded a USD 8 million ransom. Immigration systems froze, healthcare subsidies were delayed, and school certificates could not be issued. For weeks, every day, services were inaccessible, and confidence in digital governance was shaken.

What unfolded in Jakarta should not be dismissed as a distant crisis. Similar failures have already surfaced across the world. In 2023, a government misconfiguration in Bangladesh exposed the personal details of more than 50 million citizens.

In the Netherlands in 2024, records of 63,000 police officers were leaked, putting those responsible for public safety at risk. In Finland in 2020, the breach of the Vastaamo psychotherapy centre led to patients being blackmailed with their most private confessions. Similarly, in the United States, the 2015 breach of the Office of Personnel Management compromised the security clearance files of 5.6 million federal employees, an intelligence windfall for adversaries.

INDIA'S IDENTITY EXPOSURES AT SCALE

India itself has not been spared. Several Aadhaar-related incidents have already revealed the dangers of managing identity at scale. In January 2018, reporters were able to purchase unauthorised credentials online for a nominal fee, which allowed them to query the Aadhaar database and retrieve names, addresses, photos, and phone numbers in plain text. That same year, poorly secured public-sector websites and APIs exposed data linked to more than 130 million citizens.

The problem has only grown.