What CERT-In Has Reported
The Indian Computer Emergency Response Team (CERT-In) released a high-severity advisory this week detailing significant security failings in a popular third-party AI analytics platform. The report confirms that multiple threat actors exploited a previously
unknown vulnerability to gain unauthorised access to the systems of Indian companies using the software. According to the findings, the attackers were able to bypass standard authentication protocols, granting them direct entry into corporate data repositories connected to the AI. The advisory stops short of naming the specific companies affected but notes the compromised AI software is prevalent across India's fintech, e-commerce, and logistics sectors, suggesting the impact could be widespread. The primary concern is the nature of the data accessed, which reportedly includes sensitive commercial information rather than personal customer data.
The Nature of the Vulnerability
At the heart of the breach is a 'zero-day' vulnerability, a term for a flaw that is discovered and exploited by attackers before the software vendor becomes aware of it and can issue a patch. CERT-In's technical analysis points to a flaw in an Application Programming Interface (API) responsible for connecting the AI platform to other corporate software and databases. This weak point essentially created an unlocked backdoor. Attackers were able to send malicious requests to this API endpoint, which the system then treated as legitimate commands from an authorised user. This allowed them to exfiltrate data without triggering immediate alarms, a sophisticated method that underscores the evolving capabilities of cybercriminals targeting AI infrastructure. The incident serves as a stark reminder that even the most advanced systems are only as strong as their weakest link.
Why This Matters for Indian Businesses
This breach is more than just another technical incident; it’s a critical warning for the entire Indian business ecosystem. As companies increasingly integrate AI and machine learning tools to drive efficiency and gain a competitive edge, they are also expanding their 'attack surface'. Relying on third-party AI vendors means placing immense trust in their security practices. When that trust is broken, the consequences can be severe. The data exposed in this breach—client lists, internal strategic documents, and commercial forecasts—is the lifeblood of a company. In the hands of competitors or malicious actors, such information can lead to significant financial loss, erosion of competitive advantage, and reputational damage. Furthermore, under India's Digital Personal Data Protection Act, companies are held responsible for safeguarding data, regardless of whether a breach originates with a third-party vendor. This incident could therefore have serious legal and regulatory repercussions for the firms involved.
CERT-In’s Official Recommendations
In response to the findings, CERT-In has issued a clear set of directives for all organisations using the affected AI platform, and sound advice for any business leveraging third-party AI. The immediate and most urgent step is to apply the security patch released by the software vendor, which closes the API vulnerability. The agency urges IT and security teams to conduct a thorough audit of all access logs connected to the AI system, searching for any signs of suspicious activity or data exfiltration over the past few months. Furthermore, CERT-In recommends a mandatory reset of all API keys and credentials associated with the platform. To prevent future incidents, the advisory stresses the importance of implementing multi-factor authentication (MFA) for all users and services connected to external platforms. This adds a crucial layer of security that can thwart attackers even if they manage to compromise a password or an API key.
