In a major data privacy breach, personal details of more than 30,000 students and alumni of the Indian Institute of Technology Roorkee (IIT Roorkee) have reportedly been available on a public website for years, according to The Times of India (TOI). The institute has launched an internal inquiry.

Details of the breach

The leaked data, allegedly siphoned from the institute’s academic affairs department, includes mobile numbers of students and parents, caste category, financial background, email addresses, and year of admission and graduation. Anyone could access a student’s details, including photographs, by entering their enrolment number.

A professor told TOI, “Since the information on the website can be retrieved only through an enrolment number, it means the data has either been leaked or stolen from the academic affairs section. This is clearly a case of cyber security and personal privacy breach.”

“It is extremely serious that the website operator is sharing vital personal information of the institute’s students from an unknown place, and for unknown purposes. Unfortunately, the institute is not yet aware of it,” said a student.

Inquiry underway

Deputy Director U P Singh said the matter has been forwarded to the dean academic affairs and dean of student welfare. The site, allegedly active for over a decade, contains older records but no data from the current year.

Founded in 1847 as Thomason College of Engineering in Uttarakhand’s Roorkee, the institute is Asia’s oldest technical institution. It became University of Roorkee in 1949 and was upgraded to the status of an Indian Institute of Technology in 2001 by the Government of India.