UMANG: citizens' data exposed across government services
Weaknesses across several services on India's unified government app exposed EPFO account numbers, LPG booking details, and Aadhaar numbers stored in plain text. The researchers traced the root cause to how the platform was built, not to one bad service.
- Target
- UMANG app and portal (MeitY, Govt. of India)
- Bug class
- API data exposure, plaintext PII
- Data at risk
- EPFO UANs, LPG bookings, Aadhaar numbers
- Reported to
- CERT-In and MeitY
- Status
- MeitY says corrective measures are under way
- Researchers
- Akshay CS and Viral Vaghela
What is UMANG
UMANG (Unified Mobile Application for New-age Governance) is the Government of India's single app for thousands of central and state services, from provident fund accounts to gas bookings. One login reaches all of them, so a weakness in how services plug into the app can reach a lot of people at once.
What was the issue
Several service modules inside UMANG returned users' personal data through their APIs, and in some services Aadhaar numbers were stored in plain text. The Aadhaar module itself was not affected.
The researchers argued the problem was architectural: seeded in the way services were integrated into the app rather than in any single service, and possibly present for years.
What was exposed
- EPFO Universal Account Numbers (UANs)
- LPG booking details from at least one major oil marketing company
- Aadhaar numbers, stored in plain text in some services
Government response
In a statement to The Hindu, MeitY acknowledged the issues, said it had reviewed API activity logs for the previous three months and found transaction volumes normal, and said plain-text data in the affected APIs had been encrypted. It described corrective and preventive measures as under way, with the platform under continued monitoring.
Disclosure timeline
Findings reported to CERT-In and MeitY.
The Hindu publishes the findings with MeitY's response.
Follow-up coverage by Firstpost and Digit.
The takeaway. Aggregator platforms inherit the weakest integration. Every service behind a single login needs the same authorization and data-handling bar.
