Indian Aadhaar Breach 815 Million: Biometric Database of Billions Compromised

Reports emerged that personal data linked to approximately 815 million Indian citizens was found for sale on the dark web, allegedly sourced from the Indian Council of Medical Research database which connects to Aadhaar, India's national biometric identity system. The exposed data reportedly included names, Aadhaar numbers, passport details, phone numbers, and addresses. The Aadhaar system holds biometric data including fingerprints and iris scans for over 1.4 billion Indians, making it the world's largest biometric database. Previous breaches and access vulnerabilities had been documented since 2018, when a Tribune News Service investigation showed Aadhaar data could be purchased for 500 rupees. The system's mandatory linkage to banking, taxation, and government services means a compromised Aadhaar number can be used for financial fraud, identity theft, and accessing government benefits. Critics have long warned that centralizing biometric data for an entire population creates an irresistible target.

The ramifications of this incident extend beyond the immediate data exposure. Privacy regulators in multiple jurisdictions have opened investigations, and affected individuals are organizing collective action to demand accountability and meaningful remediation. The case highlights systemic weaknesses in how organizations handle personal data and the gap between corporate privacy promises and operational reality.

For impacted individuals, immediate action is critical. Filing a data subject access request forces the company to disclose exactly what data they hold about you, providing the foundation for deletion requests, regulatory complaints, and potential legal action. Below, we outline the specific data types at risk and the concrete steps you can take to protect yourself.