The Union Ministry of Health and Family Welfare (MoHFW) has reacted to media allegations alleging a data breach on beneficiaries vaccinated against COVID-19 in India.

 Although the Health Ministry has not shied away from declaring its Co-WIN portal to be completely safe, with adequate safeguards in place for data privacy, the MoHFW has also enlisted the help of the Indian Computer Emergency Response Team (CERT-In) to investigate the alleged data breach. 

According to the media allegations, a data breach involving COVID immunization beneficiaries in the country happened on some social media sites. Several tweets on the social media network Twitter stated that the personal data of vaccinated persons were acquired via a Telegram (online chat application) BOT.

In response to media allegations about data breaches, MoHFW stated that the data of the vaccinated beneficiaries could not be shared with any BOT without OTP. The ministry added that only the year of birth (YOB) is collected for adult vaccination. But the social media posts stated that the BOT collected the beneficiary’s date of birth (DOB).

Furthermore, the Ministry detailed the security procedures to monitor the CoWIN portal in a press release. The ministry explained that the data on vaccinated beneficiaries could be accessed at three levels: beneficiary dashboard, Co-WIN approved user and API-based access.

The CoWIN development team assured the MoHFW that the beneficiary data could only be accessed on public APIs with an OTP.

(Source:https://health.economictimes.indiatimes.com/news/policy/mohfw-hits-back-calls-cowin-data-breach-reports-mischievous-ropes-cert-in/100940505 )