Private firms made 17 million queries on vehicle databases between 2024-2026 before Centre cut access: RTI

Private entities made nearly 17 million queries to India’s national vehicle databases between January 2024 and September 2026, in the months before the Centre discontinued data sharing with such firms on October 1. This was revealed in response to a Right To Information (RTI) application filed by digital rights advocacy Internet Freedom Foundation (IFF).A September 1 report by cybersecurity firm Cyderes had pointed out a Telegram-based service selling vehicle records for ₹5 per lookup. (HT file photo)The National Informatics Centre (NIC), which runs the systems, disclosed that 25,314 credentials were issued to private entities during the period, allowing them to access data from VAHAN, SARATHI and related transport databases. The reply also recorded 338 credentials for private entities against 62 for government bodies, though it did not explain the difference between the two figures.Last month, the IFF raised concerns about vehicle owners’ personal information being sold through mobile applications, websites and Telegram channels. In a report published on September 23, IFF said it tested a vehicle information app with more than 10 million downloads. For ₹29, the app offered 15 searches and returned a vehicle owner’s full name, father’s name, present and permanent addresses, insurance policy number, financier, chassis and engine numbers, and pollution certificate details using only the vehicle registration number.The official Parivahan portal masks several of these details and requires an account verified through a mobile OTP.IFF subsequently wrote to the Ministry of Road Transport and Highways (MoRTH), NIC and the Indian Computer Emergency Response Team (CERT-In), seeking an investigation into how the information was reaching private services. It also filed RTIs with MoRTH and NIC on September 22, seeking details of private entities with access to the databases and action taken against alleged misuse.On October 20, IFF said NIC’s reply, dated October 16, confirmed that private data sharing was discontinued from October 1, following directions from MoRTH. However, neither the reason for the decision nor the date on which the direction was issued was disclosed. IFF said it could not establish whether the decision was linked to its representation, its RTI applications or a separate government review.The organisation also found that the vehicle information app it had tested remained available on Google Play Store as of October 17, continuing to advertise access to vehicle owners’ personal details.There was no immediate reaction from the NIC or MoRTH at the time of filing this report.NIC's reply leaves questions unansweredThe NIC reply recorded 17,079,998 queries through private credentials between January 2024 and September 2026. It also confirmed receiving a disclosure made to CERT-In on June 1 about vehicle records allegedly being sold through Telegram. However, NIC said the action taken and the date of any credential revocation were not available in the information before it.A September 1 report by cybersecurity firm Cyderes had pointed out a Telegram-based service selling vehicle records for ₹5 per lookup. According to the report, the service used credentials linked to licensed identity-verification companies rather than breaching a government server. IFF said these findings pointed to the possibility of authorised access being misused.NIC told IFF that API logs were retained for one year and SMS logs for six months, raising concerns about whether records needed for an investigation would remain available.MoRTH, meanwhile, disposed of IFF’s RTI application within two days, directing it to the ministry’s website and saying implementation of the Motor Vehicles Act fell under state and Union territory governments. IFF has challenged the ministry’s response and is filing a first appeal against NIC’s reply.While the discontinuation of private data sharing is a significant step, IFF has sought clarity on whether the move is permanent, whether recipients must delete previously obtained records, and whether vehicle owners will be informed about the unauthorised access. The organisation has also called for a public list of entities granted access to transport data and stronger technical safeguards to prevent the resale of personal information.