Discovery of the leak

The contents of the leak

• • REC ID
  • STD code
  • Blood Group
  • Mobile Number
  • Name
  • Email ID
  • Last Contacted Date
  • Pin code
  • Registration date
  • Counter
  • Password in plain text 

Data verification and validation 

Impact 

1. Threat actors can use the PII in the data dump to orchestrate phishing campaigns, online and offline scams, and even identity theft. 
2. Since the passwords are not hashed, anybody can log into a donor’s account, on the Indian Blood Donors website or app, and alter their details or act on their behalf. 
3. Since people are known to use the same password for multiple accounts, threat actors could use credential re-use attacks to compromise their email, banking, or other online accounts. 

Next Steps

The donors need to:

1. Change their Indian Blood Donors account password at the earliest. 
2. Update other accounts that use the same password. 
3. Verify that their details have not been altered in the Indian Blood Donors’ website.
4. Review all online accounts for suspicious activity. 
5. Ask friends and family to be cautious of suspicious emails from their accounts. 

Indian Blood Donors should:

1. Identify the source of the leak and fix the vulnerability at the earliest.
2. Start storing only hashed passwords
3. Get an SSL certificate for the site to upgrade it from HTTP to HTTPS.  

Disclosure