2021 CDSL — 43.9M investors, KYC API

2021 43.9M records affected

Data compromised

PAN, demat, income, tax returns

Technical writeup

CDSL Ventures KYC API authorization flaw. PAN, demat, income, net worth, tax returns, broker names. Data from 2005. 7 days to patch; re-exposed Oct 29.

Root cause

Authorization vulnerability; unprotected API

References

https://plugthebreach.in/breaches/
https://economictimes.indiatimes.com/tech/news/cdsl-breach-44-mn-investors-data-exposed-including-pan-demat-details-71636361131284.html