VAHAN data sale: Transport Ministry orders CERT-In audit of four portals

The Ministry of Road Transport and Highways has asked CERT-In, India's national cyber security agency, to carry out a security audit of four government transport portals, VAHAN, SARATHI, e-Challan and PUCC, after reports that personal details of vehicle owners were being sold online, according to reports on October 26, 2026. Investigations had found that entering a vehicle registration number on unauthorised apps, websites and a Telegram channel could return an owner's name, address and other details, for as little as Rs 5. The ministry is also reviewing its data-sharing arrangements with the Ministry of Electronics and Information Technology under the Digital Personal Data Protection Act, has asked app stores to remove apps misusing the data, and is reviewing access to the Unified Logistics Interface Platform.

VAHAN and SARATHI hold the national records of vehicles and driving licences, making them among the largest personal databases run by the government. A vehicle number is visible to anyone on the road, so if it can be used to look up the owner's name and address cheaply, it creates real risks: stalking, harassment, fraud and targeted scams. The reports show how data meant for legitimate uses, such as insurance and verification, can leak into an open market.

The key question is how the data got out. The Internet Freedom Foundation, a digital rights group that investigated the sale, has said it found no evidence that a government database was hacked. Instead, it said the operator used credentials belonging to licensed identity-verification and data-enrichment companies, which are allowed to access the records for specific purposes, while stressing that it was not claiming those firms had been compromised. If that is right, the problem lies in how access is granted, monitored and limited, rather than in a single security hole.

That makes the review of data-sharing rules as important as the audit. India's Digital Personal Data Protection Act requires organisations to use personal data only for the purposes they are permitted and to protect it with reasonable safeguards. For start-ups and companies in insurance, lending, logistics and mobility that rely on access to vehicle data through official channels, any tightening of access could change how they verify customers.

For citizens, the episode is a reminder that personal data held in government systems can travel far beyond them. Once the ministry's audit and review are complete, the findings should show whether access rules will be narrowed and how misuse will be detected in future.

Short-term: CERT-In's audit and the removal of misusing apps aim to cut off the sale of vehicle owner data. Companies with licensed access may face closer scrutiny of how they use it.

Long-term: The review could lead to tighter, purpose-limited access to transport data under the DPDP Act, affecting the many businesses that depend on it, and could set a precedent for other government databases.

Who is affected: Vehicle owners and licence holders across India, insurance, lending and logistics companies that use vehicle data, identity-verification start-ups, and the agencies that manage the portals.

Questions and Answers