Over 43 million investors’ data exposed in CVL security breach: Report

CDSL Ventures Ltd. (CVL), a subsidiary of India’s leading Demat services provider Central Depository Services Limited (CDSL), greatly suffered from a vulnerability in its systems that exposed personal and financial information of about 43 million Indian investors twice in 10 days, as per Cyber9X.

Cybersecurity startup CyberX9 reported the vulnerability to CDSL on 19th October, which the securities depository took 7 days to fix.

According to CyberX9's blog, the various data types exposed include investor name, email address, income range, phone number, PAN, father's name, date of birth, and other personal information.

For the uninitiated, CDSL is a government-registered share depository responsible for managing investor accounts on the National Stock Exchange (NSE), Bombay Stock Exchange (BSE), and other stock exchanges. Whereas, CVL is a KYC (know your customer) registration agency. Both the entities are SEBI (Securities and Exchange Board of India) registered.

Himanshu Pathak, Founder and MD of CyberX9, described the exposed data in the CDSL vulnerability as a virtual gold mine for scammers, phishers, and malicious actors aiming to spread misinformation to manipulate Indian share markets.

Pathak also mentioned that two government entities NCIIPC (National Critical Information Infrastructure Protection Centre) and CERT-In (Indian Computer Emergency Response Team), accepted their vulnerability report for CDSL.

The cybersecurity researchers at CyberX9 stated that they verified the fix before publication, and it was no longer exploitable. On October 29th, their research team discovered an easy and full bypass for the initial fix that CDSL implemented to address the previously reported vulnerability in just a few minutes.

The Chandigarh-based security firm mentioned the vulnerability was not highly complex the second time their team discovered it. They believe that the attackers have already stolen the data, and the government must conduct an impartial security audit of CDSL.

Source Credit-

https://www.moneycontrol.com/news/technology/data-breach-at-cdsls-kyc-arm-exposed-4-39-crore-investors-data-twice-within-10-days-cyberx9-7687271.html