Road Ministry seeks forensic audit of its portals after vehicle data leak

A senior Ministry official says they have sought the intervention of the Ministry of Electronics and Information Technology to review its data-sharing policy and suggest ways to strengthen it

Updated - October 25, 2026 06:35 am IST - NEW DELHI

File photo for representational purposes only. | Photo Credit: Getty Images/iStockphoto

The Ministry of Road Transport and Highways (MoRTH) has asked the Indian Computer Emergency Response Team (CERT-In) to conduct a forensic security audit of the VAHAN, SARATHI, e-Challan and PUCC portals, which hold various types of vehicle-owner information.

Also read | Roads Ministry issues public consultation guidelines for highway projects after Public Accounts Committee makes recommendations

Vahan manages vehicle-registration records; Sarathi handles driving licences and related services; e-Challan records traffic violations and fines; and PUCC manages pollution control certificates.

The move follows reports of vehicle information being sold through multiple apps and websites for as little as ₹5. One Telegram-based channel, for example, provided extensive personal data when supplied with a vehicle registration number, according to an investigation by the security firm Cyderes. Details included the owner’s full name, father’s name, present and permanent addresses, PIN code, and mobile number. It also offered driving-licence details, challan history, FASTag information, a downloadable registration certificate, and a PDF of the driving licence. Vehicle Information App (with 10 million downloads) and VehicleSetu — RC & Challan Info (with 1 million downloads) were the other popular apps identified. The Ministry has now written to major app store operators, including Google, requesting the removal of all such apps.

A senior official from the Ministry of Road Transport and Highways said they have sought the intervention of the Ministry of Electronics and Information Technology (MeitY) to review its data-sharing policy and suggest ways to strengthen it. The Ministry also plans to audit various enforcement agencies accessing its portals.

The data-sharing policy allows access to data from the National Transport Repository, a central MoRTH database that consolidates vehicle-registration and driving-licence records from VAHAN and SARATHI, as well as data from e-Challans, eDARs (Detailed Accident Reports), and FASTags.

Under the policy, government bodies, including the police, law-enforcement and national-security agencies, may access all data fields available through the various applications, in accordance with the Digital Personal Data Protection Act, 2023. Meanwhile, private entities can access only selected data fields relevant to their domain and have a daily cap on searches. Data is shared through application programming interfaces (APIs), enabling machine-to-machine access or login-based access secured by secret keys, two-factor authentication, and Aadhaar-authenticated one-time passwords (OTPs). Personally identifiable information (PII) is masked for all except law-enforcement and security agencies. All entities must possess a Security Audit Certificate from CERT-In.

Through an RTI request, the Internet Freedom Foundation (IFF) found that 25,314 credentials had been issued to private entities to access VAHAN, SARATHI, e-Challan, and PUCC data, through which 1.708 crore queries were run over a period of 33 months.

According to another senior Road Ministry official, a preliminary investigation found evidence of data misuse involving the Indian government’s Unified Logistics Interface Platform (ULIP), managed by the National Industrial Corridor Development Corporation (NICDC). The finding was based on unusually high transaction volumes, with many entities permitted to access the portal recording more than 50 lakh hits in a month.

According to a letter dated October 19, reviewed by The Hindu, the Road Ministry has asked NIC to audit the access and usage patterns of entities using ULIP and determine whether they accessed data strictly in line with the approved purpose, scope, and terms of access. The Ministry has also separately written to NICDC’s data services arm to request details regarding what due diligence was carried out before granting access to entities, the criteria used to determine an entity’s eligibility, the mechanism for establishing the scope of data access (including limits placed on shared data elements), and the process followed for monitoring and reviewing data access. Officials suspect bad actors were likely triangulating data gathered from different portals and compiling it.