No Breach Of National Informatics Centre Emails: Government Clarifies

(This was originally posted in Mint by Prasid Banerjee)

The Indian government, today, clarified that its email system, which is maintained by the National Informatics Centre (NIC), has not been breached. “The email system is totally safe and secure,” the government said in its statement. The clarification came after reports said that the recent breaches of Air India, Big Basket and Domino’s exposed email accounts and passwords of NIC to hackers.

According to the government, cyber breaches of external portals “may not impact” those who used the Government Email Service, unless those users have registered on these portals using the official emails and passwords. It also said that the NIC email system has several security measures in place, including two-factor authentication and periodic password changes (every 90 days). “Further, any change of password in NIC Email requires mobile OTP and if the mobile OTP is incorrect then change of password will not be possible. Any attempt of phishing using NIC Email can be mitigated by NIC,” the government said in the statement.

Security researcher Rajshekhar Rajharia, had earlier found the hackers were targeting ministry officials through phishing attacks. “[Alert] Hackers r sending malicious emails to government officials. They Created a website Covid19India[.]in (Now Suspended), similar to a government site. This website was accepting only govt emails to get the official’s password. The website was hosted in Pakistan,” he tweeted on June 12.

According to a report by The Hindu, emails and passwords of “hundreds” of government officials had been exposed to hackers through the data breaches suffered by corporates Air India, Domino’s and Big Basket data recently. The publication accessed internal emails that showed attempts similar to the ones pointed out by Rajharia on Twitter. Government offices, including officials from the Ministry of Defence were among the targets, the report said.

External breaches are often used by hackers to compromise user accounts elsewhere. The databases that emerge from a hack often contain email ids, usernames and passwords that a person may have used elsewhere. This becomes intelligence for motivated hackers to target an individual.

A survey by identity company SecureAuth last year found that as many as 53% users reuse passwords. This gives hackers a chance to take passwords found in one breach and use them to compromise other account.