Flaw in Diksha App Exposed the Data of Millions of Indian Students

A security lapse in an app operated by India’s Education Ministry exposed the personally identifying information of millions of students and teachers for over a year.

The data was stored by the Digital Infrastructure for Knowledge Sharing app, or Diksha, a public education app launched in 2017. At the height of the Covid-19 pandemic, when the government was forced to shutter schools across the country, Diksha became a primary tool for allowing students to access materials and coursework from home.

But a cloud server storing Diksha’s data was left unprotected, exposing millions of individuals’ data to hackers, scammers, and virtually anyone who knew where to look.

Files stored on the unsecured server contained the full names, phone numbers, and email addresses of more than 1 million teachers. According to data in the files, verified by WIRED, the teachers worked for hundreds of thousands of schools located in every state in India. Another file contained information about nearly 600,000 students. While the students’ email addresses and phone numbers were partially obscured, the data included the students’ full names and information about where they went to school, when they enrolled in a course through the app, and how much of the course they completed.

According to a UK-based security researcher who identified the exposure, there were thousands of files like this on the server. (The researcher asked not to be named because they were not authorized to speak to the media.)

After initially discovering the exposure in June, the researcher contacted the Diksha support email, alerting them to the data breach, identifying the source, and offering to share more information. They received no response. “There’s zero chance that it hasn’t been accessed and downloaded by a bunch of other people,” the employee says of the exposed data.

WIRED reached out to the Ministry of Education and did not receive a response.

Diksha was developed by EkStep, a foundation cofounded by Nandan Nilekani, who helped develop Aadhar, the country’s national identification system. According to Deepika Mogilishetty, the chief of policy and partnerships at EkStep, while the foundation had been supporting Diksha for many years, India’s Ministry of Education ultimately implements the security and policies for how data is managed on Diksha. However, after WIRED sent Mogilishetty links to the unsecured server, it was quickly taken offline.

This isn’t the first time Diksha has potentially mishandled sensitive information. A 2022 report from Human Rights Watch found that Diksha not only was able to track the location of students, but also shared data with Google. In many cases, the Indian government mandated that teachers and students use Diksha, and Hye Jung Han, a researcher at Human Rights Watch who authored the 2022 report, says that the government provided no alternative methods for those who may not have wanted to use the app.

“What’s happening there from a child-rights lens is, you are fulfilling your responsibility to provide free education to every child, but the only type of state education that you’re making available is one that inherently violates kids’ rights,” says Han.

The unsecured storage server was hosted on Azure, Microsoft’s cloud storage service. It’s unknown how long the data was left unprotected, but Google indexed more than 100 files from this server as early as October 2018. In other words, information stored on this vulnerable server was likely findable through a simple Google search for at least four years. While WIRED could not find instances of sensitive student and teacher data through a Google search, files with sensitive data were available for download through Grayhat Warfare, a searchable database of unsecured servers popular with security researchers and hackers.

“If you have information about children’s names, contact details, and what schools they attend, that tells you about the neighborhood where they live. This raises what we call traditional children’s protection concerns,” says Han. “They can also use children as a way to get to their parents—blackmail and harassment being fairly common, unfortunately, in India, specifically around education data.”

The market for student data in India appears to be thriving. In 2020, security researchers at CloudSEK, an India-based security firm, found that personally identifying information of hundreds of thousands of students who took India’s Common Aptitude Test Exam was for sale on a forum for leaked data. A year later, India Times reported that confidential data of millions of students was for sale on a website called “studentdatabase.in.”

Han also says that in India’s burgeoning data-broker market, education data like that available via the exposed Diksha server, which can be particularly appealing for prep schools to purchase, can go for as little as 2 to 5 rupees for a single child’s data.