Security Flaws in India’s UMANG Portal Expose Millions of Citizens’ Data: A Deep Dive into DPI Vulnerabilities and the Government’s AI Auditing Push
The Unified Mobile Application for New-age Governance (UMANG), India’s premier government application designed to streamline access to hundreds of public services, is at the center of a major cybersecurity controversy. Multiple systemic vulnerabilities within the portal have left the personal and financial data of potentially millions of Indian citizens exposed across several databases.
According to security researchers, these security gaps—some of which have persisted for years—impact highly sensitive databases, including those of the Employees’ Provident Fund Organisation (EPFO), state-run oil marketing companies, and digital identity records.
1. Main Facts: The Vulnerabilities and Exposed Data
The vulnerabilities within the UMANG portal stem from its core structural design rather than isolated coding errors. According to independent security researchers Akshay C.S. and Viral Vaghela, who discovered and documented the flaws, the portal’s architectural framework is fundamentally compromised.
“Almost everything is broken by design,” Vaghela stated, pointing to systemic weaknesses in how the portal communicates with individual government departments and manages user data.
The UMANG portal acts as a single-window proxy interface, aggregating over 2,400 services offered by the Union and State governments. Because it serves as a central gateway, a vulnerability in UMANG’s routing mechanisms or Application Programming Interfaces (APIs) can expose data across any of the connected backend services.
Key Data Exposed
The researchers’ findings reveal that the security gaps exposed several highly sensitive data points:
- EPFO Unique Account Numbers (UANs): Universal identifier numbers used by millions of Indian workers to manage their retirement savings and provident fund balances.
- LPG Booking Records: Detailed consumer transaction histories, including names, addresses, and booking patterns from at least one major state-owned oil marketing company.
- Plaintext Aadhaar Numbers: The most critical exposure involves Aadhaar numbers being stored and transmitted in plaintext across multiple integrated services. Under the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016, storing or displaying Aadhaar numbers in plaintext is strictly prohibited. While the core Aadhaar vault module within UMANG was not directly vulnerable, the peripheral services that save user ID details routinely violated these statutory guidelines by exposing the 12-digit numbers without encryption or masking.
2. Chronology of Discovery, Disclosure, and Mitigation
The timeline of the discovery and the subsequent responses highlights the tension between independent security researchers and government agencies regarding vulnerability disclosure and patch management.
+-----------------------------------------------------------------------------+
| TIMELINE |
+-----------------------------------------------------------------------------+
| 1. Discovery: Researchers Akshay C.S. and Viral Vaghela identify systemic |
| architectural vulnerabilities in UMANG's API routing. |
+-----------------------------------------------------------------------------+
| 2. Disclosure: Findings officially submitted to the Ministry of Electronics |
| and Information Technology (MeitY) and CERT-In. |
+-----------------------------------------------------------------------------+
| 3. Portal Offline: EPFO abruptly takes down its online portal, citing |
| system "migration." Some services remain offline for days. |
+-----------------------------------------------------------------------------+
| 4. Initial Patch: MeitY deploys an encryption patch to secure exposed APIs |
| and issues an official statement to the press. |
| |
| 5. Peer Review: Independent researcher Karan Saini reviews the patch and |
| confirms the initial fix is flawed, introducing new vulnerabilities. |
+-----------------------------------------------------------------------------+
| 6. Public Release: Official security briefings and policy updates regarding |
| government AI-driven code auditing code-named the "War Room." |
+-----------------------------------------------------------------------------+Step 1: Identification and Reporting
Researchers Akshay C.S. and Viral Vaghela identified the flaws after auditing the API traffic generated by the UMANG application. Upon confirming that sensitive user information could be queried and intercepted, they compiled a technical report. They submitted these findings directly to the Ministry of Electronics and Information Technology (MeitY) and the Computer Emergency Response Team, India (CERT-In), the national nodal agency for responding to computer security incidents.
Step 2: The EPFO "Migration" and Service Disruption
Shortly after receiving the vulnerability report, the EPFO abruptly took its online portal offline. The agency publicly attributed the downtime to a scheduled "migration" exercise. However, several critical services remained unavailable for nearly a week. The researchers suspect this sudden maintenance window was an emergency reaction to their security alerts, which had also been shared directly with the Ministry of Labour and Employment (the administrative ministry overseeing the EPFO).
Step 3: Deployment of Flawed Patches
In response to the disclosure, MeitY deployed an emergency patch intended to encrypt the plaintext data flowing through the vulnerable APIs. However, when the researchers analyzed the updated system, they discovered that the encryption protocol used was "flawed and inadequate."
According to Akshay, a simple workaround allowed the researchers to bypass the new encryption entirely. Furthermore, peer review of the patch by Karan Saini, another prominent independent security researcher, revealed that the government’s quick fix introduced an entirely new vulnerability, prioritizing obscurity over genuine security.
3. Supporting Data and Technical Assessment
To understand the scale of the potential exposure, it is necessary to examine the transaction volume handled by the UMANG portal.
Transaction Volume Analysis
UMANG is the cornerstone of India’s digital governance infrastructure. The EPFO module is the platform’s single most heavily utilized service.
| Service Name | 3-Month Transaction Volume | Comparative Scale |
|---|---|---|
| EPFO Portal | Over 400 million (40 Crore) | 15x larger than the runner-up |
| Bharat Aadhaar Seeding Enabler | ~26.6 million (2.66 Crore) | Baseline comparison |
With over 400 million transactions processed in a single 90-day window, any vulnerability affecting the EPFO-UMANG integration has immediate national security and financial fraud implications.
UMANG Service Usage Comparison (Past 3 Months)
=========================================================
EPFO Portal: [██████████████████████████████] 400M+
Aadhaar Seeding Enabler: [██] 26.6M
=========================================================The Risk of Financial Fraud
While the technical details of the vulnerability are being withheld to prevent exploitation, security experts have warned about the real-world dangers of this flaw.
Karan Saini noted that because UMANG implemented rate-limiting—a security measure that restricts the number of requests a single user can make in a given timeframe—it is highly unlikely that malicious actors could have scraped or mirrored the entire national EPFO database.
However, Saini warned of a more targeted threat vector:
"The vulnerability could potentially have been abused by cybercriminals in possession of UAN numbers to siphon funds at scale by allowing for both changing of bank account details and initiating payouts, which is very concerning."
In this scenario, bad actors who had already acquired UANs through previous corporate data leaks could use the UMANG vulnerability as an administrative backdoor. By bypassing authentication checks, they could change a victim’s registered bank account details to a mule account and file for retirement fund withdrawals, siphoning off life savings before the victim or the system detected the fraud.
4. Official Responses and the "Obscurity vs. Security" Controversy
The official response from the Indian government reflects the challenges of securing complex, legacy digital public infrastructure (DPI).
Ministry of Electronics and Information Technology (MeitY) Statement
In an official statement, MeitY acknowledged the researchers’ findings and asserted that corrective measures were underway:
“Our development and security teams have carefully examined the observations and are implementing the necessary corrective and preventive measures. The plaintext information in the concerned APIs has been appropriately encrypted.”
MeitY added that it had reviewed the API transaction logs for the past three months and found that transaction volumes remained consistent with normal usage patterns, suggesting that no anomalous, bulk data-harvesting operations had occurred during that period.
The Independent Security Rebuttal
Despite the Ministry’s assurances, security analysts remain skeptical of the fix. The researchers argued that the encryption applied to the APIs was superficial, acting merely as an obfuscation layer rather than a robust cryptographic barrier.
Saini criticized the approach, stating that the deployed fixes "appear to do nothing to secure the system and instead confuse obscurity with security."
Furthermore, Saini raised questions about the proxy-based architecture of UMANG:
“It is worth examining whether the fixes deployed on the UMANG portal were simultaneously deployed across the services for which UMANG acts as a proxy.”
If the underlying backend APIs hosted by individual departments (like the EPFO or oil marketing companies) remain unpatched, attackers could bypass UMANG entirely and target those departments directly using the same architectural exploits.
Meanwhile, the Ministry of Labour and Employment, which oversees the EPFO, declined to comment on the service outages or the specific security risks associated with provident fund accounts.
5. Broader Implications: Cybersecurity, Policy, and the AI "War Room"
The vulnerabilities discovered in the UMANG portal highlight the broader challenges of securing national digital public infrastructure (DPI) at a time when India is digitizing public services at an unprecedented pace.
+-----------------------------------------------------------------------+
| INDIA'S COOPERATIVE CYBERSECURITY MODEL |
+-----------------------------------------------------------------------+
| |
| +-------------------+ +-----------------+ |
| | U.S. Government| <=====================> | Indian Gov/MeitY| |
| +-------------------+ Technology Transfer +-----------------+ |
| || |
| Code || Audits |
| Fixes / |
| +-------------------+ +-----------------+ |
| | Anthropic Mythos | <---------------------> | CERT-In War Room| |
| | Frontier AI Model| Target Capability | (Local Models) | |
| +-------------------+ +-----------------+ |
| |
+-----------------------------------------------------------------------+The Shift Toward AI-Driven Code Auditing
The timing of these disclosures coincides with an aggressive push by the Indian government to adopt advanced artificial intelligence tools to secure its digital ecosystem. During a policy briefing, Union IT Secretary S. Krishnan detailed how the government plans to address persistent vulnerabilities in complex legacy codebases.
Krishnan revealed that India is actively seeking access to Anthropic’s advanced "Mythos" AI model, a tool designed to analyze software code and identify security flaws that have survived years of manual auditing.
“Clearly, getting access to Mythos and similar advanced models is very high on the government’s priority list, and this is something that we have discussed with our counterparts in the U.S. and with the respective companies,” Krishnan said.
The CERT-In "War Room"
To prepare for this integration, CERT-In has established a dedicated "war room" where engineers are auditing critical government code. Because access to frontier models like Mythos is currently restricted due to export controls and ongoing bilateral negotiations, the government is utilizing locally hosted, open-source AI models.
According to Krishnan, these local models are currently operating at "about 60% to 70% of the capability of Mythos." The war room is using these systems to run automated code audits, identifying and patching vulnerabilities across various e-governance portals. Krishnan described the initiative as a "dry run for whenever Mythos is available," emphasizing that maintaining the integrity of government databases is a "constant exercise."
Conclusion: The Balance Between Speed and Security
The UMANG vulnerability highlights a recurring issue in digital governance: the conflict between rapid deployment and robust security. As India positions its DPI model as a blueprint for developing nations, the security of platforms like UMANG is critical.
While the integration of AI-driven auditing tools like Mythos may offer long-term solutions for securing legacy code, the immediate challenge lies in addressing current architectural flaws. Security experts argue that until the government moves away from quick obfuscation patches and embraces transparent, peer-reviewed security protocols, public databases will remain vulnerable to sophisticated cyber threats.
