Cyber security a joke? Personal data sold for less than Re1

Personal data – phone numbers, email ids, online purchases and age, income and marital status – are reportedly being sold by companies called 'data brokers' for even less than a rupee.

The Economic Times today reported the findings of its month long investigation into the racket. Posing as prospective buyers, ET reporters approached data brokers and found that personal data of up to one lakh people was available for Rs10-15,000. In some cases the data also included credit and debit card details.

The paper purchased personal data of 3,000 people for Rs1,000 and called up a dozen people living in Delhi, Hyderabad and Bengaluru to verify the information. Online purchases on eBay and Amazon, HDFC and Axis Bank card details and other such personal information was listed in the database that the paper purchased.

An executive from a data broker firm told ET that they purchase the information from mobile service providers, loan agents, car dealers and agents from hospitals and banks. Data brokers are companies that obtain and share consumer information without their knowledge.

India's IT law does not specifically address the issue of data brokerage and privacy. Data brokerage is still at a very nascent stage in India and the market is dominated by larger international players such as Epsilon, Equifax and Experian that offer more sophisticated data sets, the Economic Times reported.

Data is also collected from social media sites, but is unstructured. Data such as tweets are collected for analytics, and can help understand consumer behaviour.

Misuse of financial data is another threat. The Reserve Bank of India registered 8,689 cases of fraud involving credit cards, ATM/debit cards and internet banking up till December 2016, ET reported. Many of these frauds are perpetrated by scammers getting customers to share critical data like CVVs or one-time passwords (OTPs).