Loading story…
A new online tool and Telegram bot called Proxyearth has emerged, enabling anyone to obtain highly sensitive personal information about Indian citizens using only their mobile phone number. Testing by security researchers confirmed that the tool provides accurate and up-to-date details, including full name, father's name, email address, telecom provider, home address, alternate phone numbers, and even Aadhaar card numbers. The service, launched in October 2025, appears to aggregate data from previously breached KYC records, leaked Aadhaar databases, and other state-linked sources, raising significant privacy and security concerns.
The existence of Proxyearth poses a severe threat to national security, as it allows for large-scale surveillance, profiling, and potential targeting of individuals, including government officials, law enforcement, and journalists. The tool's ability to pinpoint exact locations and expose comprehensive identity information highlights the ongoing risks associated with massive data breaches in India and the exploitation of sensitive government and telecom records. Authorities are being urged to investigate the source of the data and take immediate action to mitigate the threat posed by this tool.
See attribution, scope, and your downstream exposure.
2 events from the most recent confirmed update back to the earliest known activity.
SC Media reported on Proxyearth's ability to expose personal data, including Aadhaar numbers and claimed location information, for Indian citizens via mobile-number lookups. The coverage highlighted the privacy and national-security risks posed by possible insider access or aggregation of previously breached datasets.
Hackread reported that the Proxyearth website and Telegram bot could return highly sensitive personal information and apparent geolocation data for Indian citizens using only a mobile number. Its testing reportedly produced accurate current details, indicating access to large-scale telecom KYC, Aadhaar-linked, or other state-linked datasets.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
An Indian data-brokerage operation allegedly offers unauthorized access to KYC-linked personal records through a public Telegram bot and a business API platform. Its catalog reportedly includes identity, financial, employment, telecommunications, and vehicle-registration data, creating a low-cost channel for identity theft, fraud, targeted phishing, and doxxing. Prices reportedly range from INR 5 to INR 700 (about USD 0.06–8.00) per lookup. A vehicle-registration query costing INR 5 allegedly returns the registered owner’s full name, father’s name, current and permanent addresses, postal code, and mobile number, demonstrating the breadth of personally identifiable information exposed through the service.
Sep 1, 2026
India’s `.bank.in` domain program, launched to improve trust in banking websites and reduce phishing, was hit by allegations that the registration portal run by the Institute for Development and Research in Banking Technology (IDRBT) exposed sensitive data through more than **33 unauthenticated REST API endpoints**. Researcher **Srikanth L** of CashlessConsumer reported that the flaws could have exposed information tied to **5,576 bank employees** responsible for managing banking domains, including **bcrypt password hashes**, mobile numbers, email addresses, login IP addresses, and device fingerprints. The reported exposure raised concerns that attackers could use the leaked information for impersonation, phishing, and DNS-related attacks against Indian banks. The researcher said the portal remained insecure for about **13 months** and lacked a proper security audit, while many `.bank.in` domains were also found to have weak security hygiene, including limited adoption of **DNSSEC** and **DMARC** and, in some cases, hosting on shared international servers. IDRBT reportedly fixed the exposed API flaws after disclosure, while public responses from IDRBT, the Reserve Bank of India, and the Indian government were not available at the time of reporting.
Jun 30, 2026
Indian officials and agencies are pushing to broaden the use of digital identity in both public and private contexts, while explicitly raising cybersecurity and accountability concerns. In Hyderabad, Police Commissioner **V.C. Sajjanar** publicly argued that autonomous **AI agents** operating in critical sectors (e.g., banks, hospitals, power grids) should be issued a verifiable *digital identity* and be subject to strong **logging and traceability** so investigators can determine “which agent opened which file,” what changes were made, and where data was sent—framing the need as a safeguard against errors and the risk of **cybercriminals hijacking agent behavior**. Separately, India’s **UIDAI** is expanding **Aadhaar** into more day-to-day use via a new Aadhaar app and an **offline verification** framework intended to reduce reliance on real-time checks against the central database, while enabling *selective disclosure* (e.g., proving age without sharing full birthdate). The initiative also extends Aadhaar into consumer ecosystems (including planned **Google Wallet** integration and discussions with **Apple Wallet**) and into operational deployments such as policing and hospitality—e.g., Ahmedabad City Crime Branch integrating Aadhaar-based offline verification with the **PATHIK** guest-monitoring platform—prompting critics to reiterate concerns about **security, consent, and privacy** as Aadhaar’s footprint grows.
Jun 29, 2026