₹2 buys a stranger's home address. We tested a Play Store app with 10M+ downloads selling VAHAN/eChallan data, one number plate gave us the owner's full name, father's name, permanent address, insurance policy, chassis and engine numbers, all of which Parivahan masks behind an OTP.
This isn't a hack. Researchers at Cyderes traced it to licensed API keys given to KYC companies, now resold on Telegram.
IFF has written to MoRTH, NIC & CERT-In demanding a forensic audit, and filed RTIs on 22 Sept. Found your own data on these apps or similar website? Write to policy@internetfreedom.in