Indian Blood Donors

Summary

A data leak exposed sensitive information of over 12,000 blood donors registered with an Indian blood donor organization, including personally identifiable information, blood types, and plaintext passwords. The database was advertised on multiple forums and freely accessible, enabling unauthorized account access to modify donor details or impersonate users. The credentials also posed risks for credential-stuffing attacks on other platforms due to password reuse. The organization reportedly failed to respond to prior security notifications, leaving donor data unprotected. This incident reflects broader concerns about inadequate data protection practices within India's healthcare sector, mirroring previous similar breaches involving unsecured medical information.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On or around June 12, 2020, cybersecurity firm CloudSEK discovered a data leak involving the Indian Blood Donors organization, which operated the website www.indianblooddonors.com and a companion mobile application. The leak exposed sensitive information belonging to 12,472 registered blood donors. CloudSEK researchers identified forum posts advertising free access to the organization’s database, which contained donors’ personally identifiable information (PII), blood types, and account passwords stored in plain text. The researchers obtained and validated the entire database without cost, confirming its authenticity. The compromised data enabled unauthorized parties to access donor accounts on the Indian Blood Donors platform, modify personal details, or impersonate donors. The platform’s function of matching blood recipients with donors based on proximity and blood type raised additional concerns about potential misuse of the exposed location and health data.

The incident represented a recurrence of security failures in India’s healthcare data systems, following a similar 2019 breach involving another online blood bank that also ignored breach notifications. Indian Blood Donors failed to respond to security warnings prior to the data’s appearance on criminal forums, leaving donor accounts actively vulnerable. The plaintext password storage exacerbated risks, as credential reuse could facilitate attacks on donors’ other online accounts. No containment actions or remediation efforts by the organization were documented in available reports. Consequences included the exposure of donors to identity theft, fraudulent account activity, and targeted spam, while the broader pattern of unsecured health data highlighted systemic deficiencies in India’s protection of sensitive personal and medical information. The database remained accessible on multiple forums frequented by threat actors at the time of disclosure.

Sources

Sources available to members: 1 source.