Amid data leaks involving SBI customers and Rajasthan government records, the latest cyber analysis of major data leak incidents in India has highlighted recurring cybersecurity failures, including misconfigured
servers, compromised credentials, insider involvement, weak access controls and inadequate monitoring of third-party systems.
The assessment was recently conducted to identify common causes behind data leaks and thefts. The broader concern is that organisations often discover vulnerabilities only after outsiders have identified or exploited them.
According to an official familiar with the analysis, several high-profile data exposures were not necessarily the result of sophisticated cyberattacks but stemmed from basic security lapses that allowed unauthorised access to sensitive information.
An official familiar with the analysis said the findings point to common vulnerabilities across government departments, financial institutions and healthcare platforms.
“The analysis shows that misconfigured systems, misuse of authorised credentials, excessive access privileges and inadequate monitoring of third-party vendors have emerged as recurring reasons behind major data leaks,” the official said, quoting the analysis conducted by a central agency. The official also added that the use of pirated and unauthorised software introduces additional vulnerabilities.
The analysis examined incidents involving the Indian Council of Medical Research (ICMR), CoWIN, State Bank of India (SBI), AIIMS Delhi and data-selling networks uncovered by various police forces.
The ICMR-related COVID-19 data exposure in 2023 raised concerns about information being accessible across multiple systems. Investigators linked the alleged sale of records to data brokers and cybercriminals, although the precise entry point was never publicly established.
The CoWIN controversy in 2023 similarly highlighted the risks of credential misuse. The government said the reported exposure involved the credentials of a health worker and not a direct breach of the platform.
In 2019, an independent researcher identified an unprotected server associated with SBI, illustrating how basic configuration failures could expose sensitive information. Similarly, the latest SBI data leaks have raised concerns about the possible role of insiders.
Another major concern is that government agencies often fail to detect leaks themselves. Instead, these incidents come to light after being flagged by private individuals or organisations. The latest SBI data leak, for instance, came to notice after the data was reportedly put up for sale on the dark web.
Private Agencies Often Detect Breaches First
Another significant finding is the role of private cybersecurity firms and independent researchers in identifying suspected data exposures. In several cases, external researchers, security companies or threat intelligence providers detected suspicious activity before affected organisations publicly acknowledged the problem or government agencies became involved.
The ICMR-related exposure was flagged by a US cybersecurity firm. The latest SBI incident in 2026 also brought attention to external alerts, with the bank receiving information from its threat intelligence service provider, CERT-In and the Defence Cyber Agency before initiating an investigation.
Weak Monitoring Compounds Cybersecurity Risks
The analysis also identifies inadequate network segmentation, outdated infrastructure and delayed incident detection as recurring concerns.
The 2022 ransomware attack on AIIMS Delhi demonstrated how weaknesses in interconnected systems could allow an attack to spread. The ransomware moved from one server to another with little indication that the activity had been detected in time.
The analysis further points to the risks posed by employees, contractors and third-party vendors with extensive access to sensitive databases.
The findings underline the need for regular security audits, stronger authentication mechanisms, restricted access privileges and continuous monitoring to prevent similar incidents.
