ICMR India

In October 2023, a threat actor posted on a hacking forum offering to sell a database allegedly belonging to the Indian Council of Medical Research (ICMR) for 80,000 USD. The seller claimed the dataset contained 815 million records, making it one of the largest alleged breaches in Indian history. However, the database was never publicly released at that time. In 2025, a dataset of similar scale resurfaced online, prompting renewed investigation. Forensic analysis of the 2025 leak revealed significant signs of fabrication: the dataset appeared to consist of approximately 100 million genuine records of Indian citizens, into which approximately 715 million randomly generated lines had been artificially inserted. It remains unclear whether the original 2023 actor fabricated the inflated record count, or whether a separate party later manipulated the authentic 100 million record dataset to match the originally claimed ICMR breach size. The verified authentic portion of the data contains personally identifiable information including phone numbers, full names, and residential addresses. Critically, approximately 500,000 Aadhaar identification numbers were also found within the real records, raising serious concerns about identity fraud and misuse of biometric-linked government IDs for Indian citizens.