According to The Hindu, the insurance portal of Indian Railway Catering and Tourism Corporation (IRCTC) contained a critical data exposure vulnerability [1]. The report stated that sensitive passenger data was at risk of exposure or unauthorized access and that the portal was subsequently patched [1]. The types of affected data and whether bulk downloads occurred are governed strictly by the original report [1].
This event has not been officially confirmed. Content is based on media or third-party reports.
Backfill: this event became public on Aug 5, 2024 and we added it on Nov 8, 2026. It is not a new event.
HighMonitoringBackfillMedia reported
Indian Media Reports Critical Data Exposure on IRCTC Insurance Portal Has Been Patched
1 min read
- Disclosed
- Aug 5, 2024
- Published
- Nov 8, 2026
- Last updated
- Nov 7, 2026
- CVSS basis
- Our assessment
- Attack vector
- Data type
- Actor type
- Motivation
On this page
30-second summary
What happened
Who is affected
Industries mainly affected: Finance, Transportation & logistics
What to do nowOur advice
The types of affected data and whether bulk exfiltration occurred follow the original report [1].
Timeline
- Incident publicly disclosed[1]
Technical details
Source-Supported Details
The Hindu reported a critical data exposure on the IRCTC insurance portal that has since been patched. Where the original article describes the issue as data accessibility resulting from a vulnerability, this entry does not add unverified threat group attribution, and uses the publication date where only an approximate timeline is available [1].
Source excerpt: "The Indian Railway Catering and Tourism Corporation (IRCTC) has addressed a critical vulnerability on its insurance portal that previously allowed unauthorised access to passengers’ travel details and enabled changes to nominee information in the insurance policy." [1].
References
Media1
- [1]
“The Indian Railway Catering and Tourism Corporation (IRCTC) has addressed a critical vulnerability on its insurance portal that previously allowed unauthorised access to passengers’ travel details and enabled changes to nominee information in the insurance policy.”
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.