Major data leak from UPSTOX traing portal

Excellent study material for all civil services aspirants - begin learning - Kar ke dikhayenge!

  Major data leak from UPSTOX traing portal

---

Read more on - Polity | Economy | Schemes | S&T | Environment

---

1. The story: Retail broking firm Upstox alerted customers of a major security breach that included contact data and KYC details of customers, but assured users that their funds and securities remain safe. In recent data, there've been similar reports of data breaches at MobiKwik, Facebook and LinkedIn also.
2. What Upstox said: "On receipt of e-mails claiming unauthorised access into our database, we have appointed a leading international cyber-security firm to investigate possibilities of breach of some KYC data stored in third-party data warehouse systems. This morning, hackers put up a sample of our data on the dark web." The spokesperson added that as a proactive measure, the company has initiated multiple security enhancements, particularly at the third-party warehouses, real-time 24x7 monitoring and additional ring-fencing of its network.
3. Don't worry, your money is safe: Upstox said funds and securities of all Upstox customers are protected and remain safe. We have also duly reported this incident to the relevant authorities. The company said it didn't know with certainty the number of customers whose data had been exposed. Upstox is backed by investors like Tiger Global and Ratan Tata, has over three million users. On the company website, Upstox co-founder and CEO Ravi Kumar said funds and securities of customers are protected and remain safe.
4. How safe: It said "Funds can only be moved to your linked bank accounts and your securities are held with the relevant depositories. As a matter of abundant caution, we have also initiated a secure password reset via OTP. Through this time, we have also strongly fortified our systems to the highest standards." 
5. More: The company has ramped up its bug bounty programme to encourage ethical hackers to stress test its systems and protocols and help it identify any vulnerabilities from time to time. The company urged customers to always use unique strong passwords that are different from older versions and to not share OTPs with anyone. It also urged the customers to beware of online fraud and double-check the legitimacy of links and senders, to watch out for OTPs that they have requested and to alert the service provider in such events.
6. Mobikwik data breach: In March 2021, important user information including mobile phone number, bank account details, email, and even credit card numbers of 9.9 crore Mobikwik users was leaked. The screenshots of the Mobiwik breach were posted on Twitter by a French security researcher who goes by the name Elliot Alderson. He called it the “largest KYC data leak in the history”. Mobikwik denied this leak, but since the data of Mobikwik founder Bipin Preet Singh and Mobikwik CEO Upasana Taku itself was leaked from the database, the breach did happen.
7. LinkedIn data breach: Professional networking site LinkedIn faced a major data breach, as data of more than 500 million users was leaked. The data was listed on hacker forums. LinkedIn claimed that all the data was not picked up from its platform, instead of from a number of websites and companies. It said it had determined that it is actually an aggregation of data from a number of websites and companies.
8. Facebook data breach: Facebook decided not to notify over 530 million of its users whose personal data was lifted in a breach sometime before August 2019 and was made available in 2021, in a public database. Phone numbers, full names, locations, some email addresses, and other details from user profiles were posted to an amateur hacking forum. The leaked data includes personal information from 533 million Facebook users in 106 countries. Facebook said that "malicious actors" had scraped the data by exploiting a vulnerability in a now-defunct feature on the platform that allowed users to find each other by phone number. The social media company said it found and fixed the issue in August 2019 and its confident the same route can no longer be used to scrape that data.

Read more on - Polity | Economy | Schemes | S&T | Environment

Join UPSC Self Prep course | Online Course (PT Gurukul)  | Covid Special Course | Join PT courses

* Content sourced from free internet sources (publications, PIB site, international sites, etc.). Take your own subscriptions. Copyrights acknowledged.